The Fall of xxxcompany, our real customer.

Initial Access

The attacker discovered an outdated plugin on a public WordPress subdomain. They used a command-line scan to identify vulnerabilities.

Remote Code Execution

Once the vulnerable plugin was confirmed, a crafted PHP shell (shell.php) was uploaded via the file handler.

Then accessed with.

Persistence

A scheduled task was created to run a hidden user account every time the system rebooted.

Privilege Escalation

Using the PrintNightmare vulnerability (CVE-2021-34527), they exploited remote print service to run malicious DLLs.

Defense Evasion

They disabled Defender and cleared logs

Credential Access

Dumped LSASS memory and extracted credentials

Discovery

Mapped domain with BloodHound and PowerView.

Lateral Movement

Used PsExec and WMI to hop to internal machines

Collection

Command and Control (C2)

Maintained persistence via encrypted Cobalt Strike beacons over DNS

Exfiltration

Data was tunneled out during non-working hours

Impact – Ransomware Deployment

Finally, ransomware payload was executed across the network

All files were encrypted. A ransom note appeared: