A single EDR alert showed a file named bugbug.exe had been quarantined on a hosting company’s servers. The location was suspicious: C:\Users\Public\Music, a folder threat actors favor precisely because it draws less scrutiny than a standard application directory, and the name was strange. It was the tip of an iceberg.
A login, not a break-in
Flight Recorder, our MDR analyst’s forensic search tool, showed an RDP session live on the server, authenticated through a legitimate account. Nobody had broken in. Someone had signed in.
Makop ransomware
The attacker’s first attempt to run ransomware on the server was blocked by ThreatDown EDR. Rather than give up, they mapped a drive from their own machine into the session over the RDP connection, where it surfaced on the server as \\tsclient, and launched the payload from there. Because the file never touched the server’s disk, it bypassed file-based defenses.
Makop ransomware detonated on the application server, and the Makop extension began to appear in the activity log as the malware started encrypting files.
Our analyst:
- Isolated the server from the network to contain the attack.
- Terminated the live RDP processes with the Active Response Shell.
- Escalated to the customer with a full account and specific remediation guidance.
From first alert to containment took just 14 minutes.
Insider threat
The customer recognized immediately that the attacker’s account belonged to a former employee. The account was hidden, known to only four people inside the organization, and protected by a 120-character password. This wasn’t an unknown adversary probing for a way in, but someone who had once been trusted, who knew the environment, and who still held credentials that should have been retired long ago.
The customer disabled the account on the spot, and the attacker’s access ended with it.
Had the ransomware spread beyond its bridgehead it could have disrupted hosting, impacted client data, and compromised the company’s reputation.
Thankfully, none of that happened. Our 24/7 monitoring detected and contained the attack in 14 minutes. We called the customer, who shut the compromised account down, and the attacker had nowhere else to go.
Insider threats are among the hardest attacks to anticipate because the credentials are real, and the entry leaves no obvious signs of forced intrusion. When the threat comes from someone who already knows the environment, perimeter defenses offer little protection.
Your team responded as expected, if not even better than expected. By the time I landed from my flight, it was already handled.
CTO, Canadian cloud hosting provider
Reconstrucción
Desde la primera señal hasta el traspaso completo
A strange file
A file named bugbug.exe appears in a server’s music folder, and catches our analyst’s attention.
A remote login
Flight Recorder shows someone is on the server, connected using a legitimate RDP account.
Ransomware
The attacker launches a remote ransomware attack by mapping a drive from their own machine. Makop detonates.
Lockdown
Our analyst isolates the server and terminates the RDP session, cutting off the attack.
A known account
The customer recognizes the account. The hidden account, known to only four people and protected by a 120-character password, belongs to an ex-employee.