Scenario#

“The adversary now holds two of the three Primal Keys the Etherian and the Obscuran. Only one remains: the Nullform Key, a relic of entropy and rebirth, said to lie dormant beneath the ruins of lost systems.”

Deep within Empathreach (home of NGO-Hub), a vast humanitarian nexus connecting relief efforts across high-risk zones, lies an ancient artifact containing metadataa locator for the Nullform Key. Subtle signs of intrusion have emerged: strange outbound traffic, hints of lateral movement, and irregular authentication spikes.

Mission: Map the adversary’s previous infiltration, chart their movements, and ensure Empathreach is fortified against future incursions.

Attack Summary#

Victim: Elena Nygaard (elena.nygaard@ngohubcloud.onmicrosoft.com)
Target Organization: Empathreach / NGO-Hub
Attack Type: Multi-stage phishing Credential theft MFA bypass Cloud exploitation Data exfiltration

Attack Chain#

1
1. Initial Compromise (Phishing)
2
    Email with ngo_update.png attachment
3
    Malicious link: http://login.mcrosoft.com/login.html
4
    Credential harvesting via login.php
5

6
2. Authentication Bypass
7
    Multiple MFA failures (08:05-08:07 UTC)
8
    Successful login: 08:15:49 UTC
9
    Azure Portal access gained
10

11
3. Lateral Movement
12
    Azure Cloud Shell initiated (08:48:26 UTC)
13
    Command: az ssh arc --resource-group ngo1 --name db
14
    Target: Database server (DB.ngo-hub.com)
15

16
4. Data Exfiltration
17
    Tool: mysqldump.exe (MariaDB 12.0)
18
    Target: donorrecords table
19
    Output: db_dump.sql

Critical IOCs#

Domains:

• login.mcrosoft.com (Typosquatting - Microsoft)

IP Addresses:

• 203.0.113.10 (Attacker authentication source)

Compromised Credentials:

• Username: elena.nygaard@ngohubcloud.onmicrosoft.com
• Password: Jopa373424

Malicious Infrastructure:

• SMTP Hostname: attacker01

1. Email Forensics#

• Analyzed .eml files to identify phishing attachments
• Extracted sender information and email headers
• Identified social engineering tactics

2. Network Traffic Analysis#

• Wireshark analysis of network_capture.pcapng
• HTTP traffic inspection to phishing domain
• DNS resolution tracking

3. Azure Log Analysis#

• Excel/PowerShell parsing of Azure sign-in logs
• Timeline reconstruction of authentication events
• MFA failure pattern analysis
• Successful login timestamp identification

4. Mail Server Log Analysis#

• SMTP protocol analysis from hmailserver logs
• EHLO hostname extraction
• Email routing investigation

5. Cloud Shell Forensics#

• Session log parsing (cloudshell_session.log)
• Azure CLI command extraction
• Lateral movement technique identification

6. Database Forensics#

• SQL dump analysis (db_dump.sql)
• Table structure examination
• Exfiltrated data assessment

7. Windows Event Log Analysis#

• Sysmon process monitoring review
• Process execution tracking (mysqldump.exe)
• Parent-child process relationships

Phishing Infrastructure#

Domain Typosquatting:

1
Legitimate: microsoft.com
2
Malicious:  mcrosoft.com (missing 'i')

Credential Harvesting Flow:

1. Victim receives “Security Verification” email
2. Clicks malicious link to fake Microsoft login
3. Enters credentials into phishing form
4. login.php captures and stores credentials
5. Possible redirect to legitimate site (to avoid suspicion)

MFA Bypass Analysis#

Timeline of MFA Attempts:

• Multiple “Strong Authentication is required” prompts
• Repeated “Authentication failed during strong authentication request”
• Eventually successful: “MFA requirement satisfied by claim in the token”

Possible Bypass Methods:

1. MFA Fatigue Attack (repeated prompts until victim approves)
2. Social Engineering (victim provides MFA code)
3. Session Token Theft
4. Compromised Authentication Method

Azure Arc SSH Exploitation#

Command Executed:

1
az ssh arc --subscription 65f29041-a905-45dd-aebd-6fbf877ed89e \
2
           --resource-group ngo1 \
3
           --name db \
4
           --local-user enygaard

Why This Matters:

• Azure Arc enables management of on-premises servers through Azure
• SSH access bypasses traditional firewall rules
• Legitimate Azure service abused for lateral movement
• Difficult to detect without proper cloud monitoring

Database Exfiltration#

Tool: MariaDB mysqldump utility
Path: C:\Program Files\MariaDB 12.0\bin\mysqldump.exe

Typical Command:

1
mysqldump -u username -p password -h host database_name > db_dump.sql

Impact:

• Complete donorrecords table exfiltrated
• PII exposure (donor names, emails)
• Financial data (donation amounts)
• Campaign attribution data
• GDPR/compliance violations

Security Gaps Identified#

1. User Awareness:

   • Failed to recognize typosquatting domain
   • Did not verify HTTPS before entering credentials
   • Susceptible to social engineering

2. Email Security:

   • Phishing emails reached inbox
   • No link protection or URL rewriting
   • Insufficient email filtering

3. MFA Implementation:

   • MFA bypass was successful
   • No phishing-resistant MFA (FIDO2)
   • Possible MFA fatigue vulnerability

4. Cloud Security:

   • Overly permissive Azure access
   • Azure Arc SSH not properly restricted
   • Cloud Shell permissions too broad

5. Database Security:

   • Insufficient database access controls
   • No data exfiltration detection
   • Missing audit logging

Immediate Actions#

1. Reset all compromised credentials
2. Revoke active Azure sessions
3. Block malicious domain and IP
4. Disable Azure Arc SSH temporarily
5. Enable database audit logging

Short-Term Actions#

1. Deploy phishing-resistant MFA (FIDO2)
2. Implement Conditional Access policies
3. Enable Microsoft Defender for Cloud
4. Conduct security awareness training
5. Implement email security gateway

Long-Term Actions#

1. Adopt Zero Trust architecture
2. Implement Privileged Access Management
3. Deploy Data Loss Prevention (DLP)
4. Establish 24/7 SOC monitoring
5. Conduct regular security audits