Hexastrike Details S5PIVOT Proxy in Qilin Ransomware Intrusion

Article Details

Attack Vectors

• Initial access most likely used valid domain credentials to log on through the SonicWall SSL-VPN, which did not require MFA; the article reports no evidence of an exploit, phishing, or unauthorized remote-support access.
• The operator tested credentials against domain accounts and used a password spray against the built-in Administrator account; shared local administrator passwords and accounts already holding Domain Admin rights enabled broader access.
• The backup account, which had Domain Admin rights, was used for WinRM sessions to deploy S5PIVOT and run exfiltration activity.
• S5PIVOT persisted through a SYSTEM scheduled task that repeatedly launched an embeddable Python runtime; a sitecustomize.py hook loaded the proxy payload without a script appearing on the command line.
• AzCopy commands copied selected business documents to an attacker-controlled Azure blob container. The article reports that the amount transferred and full object list could not be recovered.
• The Qilin/Agenda encryptor disabled recovery-related services, encrypted files including system directories, cleared Windows event logs, and persisted through a Run registry value that later relaunched it.

Defensive Notes

• Require phishing-resistant MFA on remote-access paths, restrict VPN access to managed devices or expected locations, forward VPN logs centrally, and retain them for several months.
• Alert on VPN-originated NTLM logons with default or unrecognized workstation names, and on bursts of event 4776 credential-validation failures interleaved with successful logons for the same accounts.
• Limit privileged group membership, prevent service accounts from using Domain Admin or Enterprise Admin privileges, use group managed service accounts where appropriate, and remove unnecessary local administrator grants.
• Use Windows LAPS to provide unique, automatically rotated local administrator passwords across machines.
• Apply application control to prevent interpreters from running out of writable locations such as ProgramData; alert on recurring interpreter tasks without script arguments, numeric task names, and suspicious Register-ScheduledTask commands.
• Restrict server egress to approved destinations and alert on new, long-lived TLS sessions and unusual outbound volume. Where feasible, limit uploads to organizational storage accounts.
• Alert on shadow-copy deletion, backup or database services being disabled, suspicious Defender policy changes, and unusual SMB or symbolic-link configuration changes.
• Forward Security, System, PowerShell, and Sysmon events to central storage as they are written; retain them for at least 90 days and alert on event 1102 and bursts of event 104.
• Neutralize suspicious scheduled tasks and autostart entries before interactive logon to affected hosts; maintain backups protected by separate credentials and test restores regularly.