Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline Threat Campaign

T1190

Exploit Public-Facing Application

MITRE Detection Strategy DET0080 / AN0219: Adversary sends crafted input to an internet-facing app; the chain runs abnormal request patterns to a public endpoint, then elevated 4xx or 5xx or unusual methods, then a server process spawning a shell or LOLbins. [Campaign: the GlobalProtect forge chain and SQLi campaigns hit VPN and web endpoints; watch for the auth endpoint hit followed by anomalous session issuance.]

T1133

External Remote Services

MITRE Detection Strategy DET0354 / AN1004: Unusual external remote access followed by a successful session from uncommon geolocations or outside business hours, then internal lateral movement or exfiltration. [Campaign: recovered output shows working VPN sessions with assigned addresses and routes on seven gateways; alert on GlobalProtect sessions with forged-cookie fingerprints.]

T1059.003

Command and Scripting Interpreter: Windows Command Shell

MITRE Detection Strategy DET0202 / AN0578: Detects abuse of cmd.exe or shell invocation chains, focusing on parent-child relationships where cmd is launched from unusual parents and chained with discovery or credential access. [Campaign: sqlservr.exe spawning cmd.exe or powershell.exe via xp_cmdshell is the operation's pivot from SQL injection to host execution.]

T1003.002

OS Credential Dumping: Security Account Manager

MITRE Detection Strategy DET0085 / AN0235: A SYSTEM-level process accesses registry keys to dump the SAM hive, often with sequential access to HKLM\SAM and HKLM\SYSTEM and creation of .save or .dmp files. [Campaign: the operator extracted base64-encoded SAM, SYSTEM and SECURITY hives for offline cracking under a SQL service identity.]

T1003.003

OS Credential Dumping: NTDS

MITRE Detection Strategy DET0586 / AN1611: Detects NTDS.dit dumping by monitoring shadow copy creation, suspicious access to ntds.dit, and use of tooling such as ntdsutil.exe. [Campaign: a valid Active Directory database was recovered, and Evil-WinRM history shows attempts to copy the AD database from a tunneled domain controller.]

T1048.003

Exfiltration Over Unencrypted Non-C2 Protocol

MITRE Detection Strategy DET0149 / AN0423: Detects data access or staging followed by outbound flows over unencrypted protocols initiated by unexpected processes or to rare destinations. [Campaign: hunt for high-entropy DNS queries to unknown resolvers; a single host emitted 470,268 marker-prefixed subdomain queries to the operator's sink.]

T1567.002

Exfiltration to Cloud Storage

MITRE Detection Strategy DET0570 / AN1571: Unusual processes accessing large local files then initiating HTTPS to cloud-storage domains; correlate file reads in sensitive directories with uploads. [Campaign: a single-use rclone script filters roughly 140 sensitive file types and syncs to cloud storage with eight-stream transfers.]

T1071.001

Application Layer Protocol: Web Protocols

MITRE Detection Strategy DET0027 / AN0075: Detects unexpected or high-volume HTTP or WebSocket communication from suspicious processes using uncommon user agents or mimicking browser traffic to unusual domains. [Campaign: the AdaptixC2 HTTP listener on port 8443 and WebSocket API on 4321 at 91.92.241[.]187 carry gopher beacon traffic.]

T1095

Non-Application Layer Protocol

MITRE Detection Strategy DET0457 / AN1254: Anomalous use of non-web protocols by processes that do not normally generate such traffic, especially where flows bypass proxy infrastructure. [Campaign: the AdaptixC2 GOPHER_4444 TCP listener on port 4444 is raw-socket C2 outside normal web egress.]

T1505.003

Server Software Component: Web Shell

MITRE Detection Strategy DET0394 / AN1108: Unexpected file creation in web directories followed by web server processes such as w3wp.exe spawning command shells or script interpreters. [Campaign: minimal JSP command-execution webshells and a Metasploit WAR payload were staged against Tomcat hosts reached after VPN pivoting.]

T1053.005

Scheduled Task/Job: Scheduled Task

MITRE Detection Strategy DET0441 / AN1221: Detects creation or modification of scheduled tasks via Task Scheduler, WMI, PowerShell or API, including hidden or anomalous tasks under suspicious contexts. [Campaign: persistence was attempted through scheduled tasks with plausible service-like names, though durable persistence is not confirmed.]

T1090.003

Proxy: Multi-hop Proxy

MITRE Detection Strategy DET0359 / AN1020: Suspicious processes launch sustained encrypted outbound traffic to anonymity infrastructure and may relay to internal systems via reverse proxying or socket forwarding. [Campaign: scan and exploit origin is masked behind proxy hops, and a Ligolo-style reverse tunnel carries internal routing across two /24 ranges.]

T1657

Financial Theft

MITRE Detection Strategy DET0495 / AN1361: Monitor for mass emailing of payment instructions, sudden mailbox rule changes for financial staff, and anomalous access to financial or ERP systems. [Campaign: the master-panel dispatches fake-invoice email, SMS and WhatsApp at scale; hunt lookalike domains and the invoice URL schema carrying ?ref=, &venc= and &v0=.]

T1134.001

Access Token Manipulation: Token Impersonation/Theft

MITRE Detection Strategy DET0482 / AN1324: Detects token duplication and impersonation by correlating suspicious command lines with API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser. [Campaign: GodPotato is staged as C# source and a compiled .NET binary for token-impersonation local privilege escalation from service contexts.]

T1027

Obfuscated Files or Information

MITRE Detection Strategy DET0378 / AN1064: Correlates script execution or suspicious parent processes with creation of encoded or encrypted file formats and abnormal command-line or PowerShell obfuscation. [Campaign: shellcode is XOR-wrapped with keys 0x37 and 0x41 and the FUD loader adds AES-128-CBC with hardcoded keys before execution.]