Ransomware Operators Exfiltrated 410 GB After Exploiting Stale Accounts and Unmanaged Systems
Summary
An incident response case describes INC operators exploiting weak FortiGate access and stale, over-privileged accounts to move laterally, exfiltrate about 410 GB, and encrypt systems lacking EDR.
Key points
- Attackers brute-forced an internet-exposed FortiGate admin panel lacking MFA, rate limiting, and account lockout, then obtained credentials from its configuration backup.
- They used a stale partner account for VPN access and a Domain Admin service account with a 1,408-day-old password to access 17 systems.
- A SQL server without EDR was used to exfiltrate about 410 GB of business documents over roughly 21 hours using Rclone and Wasabi S3.
- INC ransomware was blocked on hosts with EDR; systems without the agent were encrypted. The response team and managed services partner restored 17 VMs from backup.
- The article recommends restricting appliance management access, reviewing third-party accounts and service-account privileges, ensuring complete EDR coverage, monitoring server egress, and protecting backup infrastructure.
Article Details
- Victim Organization
- Unknown
- Incident Type
- Credential-based intrusion, data exfiltration, and ransomware deployment
- Data Types Exposed
- Office documents
- PDFs
- Affected Data Size
- Approximately 410 gigabytes exfiltrated
- Operational Impact
- Systems without EDR were encrypted. The managed services partner restored 17 VMs from backup.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | wasabisys[.]com | Identified as the Wasabi S3 destination used to exfiltrate stolen data. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe attacker conducted host enumeration across the environment from a system identified by a Kali Linux hostname.T1021.001 · Remote Desktop ProtocolThe service account was used to establish RDP sessions across 17 systems.T1059.003 · Windows Command ShellThe attacker used cmd.exe, net.exe, and net1.exe on multiple hosts.T1078 · Valid AccountsThe attacker used a stale partner account and an over-privileged service account.T1078.002 · Domain AccountsThe stale partner account was added to the SSL VPN user group and used for VPN access.T1098 · Account ManipulationThe attacker added the partner account to the VPN group and changed the Veeam backup service account password.T1110.003 · Password SprayingThe attacker brute-forced the FortiGate admin interface using credential stuffing.T1133 · External Remote ServicesThe attacker accessed the internet-facing FortiGate management panel.T1135 · Network Share DiscoveryThe attacker enumerated network shares using net share.T1486 · Data Encrypted for ImpactINC Ransomware encrypted systems where EDR was not deployed.T1489 · Service StopThe attacker stopped CryptSvc, swprv, and vss before encryption.T1490 · Inhibit System RecoveryThe attacker deleted Volume Shadow Copies to inhibit recovery.T1562.001 · Disable or Modify ToolsThe attacker stopped CryptSvc, swprv, and vss across multiple hosts.T1567.002 · Exfiltration to Cloud StorageRclone was used to exfiltrate approximately 410 GB to Wasabi S3 over about 21 hours.
Threat Actors
Malware
Vendors
Products
Fortinet FortiGateIncident Response engagement, no supply chain compromise, no sandbox escape. This is a story about a FortiGate admin panel on the internet, an account that should have been disabled two years ago, a service accountVeeamThe service account started RDP sessions across the environment: file servers, hypervisors, the ERP system, domain controllers, the Veeam backup server. 17 systems in total.
Tools
Countries
Brazilno MFA. A local admin account fell to credential stuffing from a rotating set of IPs across Russia, Iran, Brazil, and various proxy providers. The login succeeded. Nobody noticed.Iranno MFA. A local admin account fell to credential stuffing from a rotating set of IPs across Russia, Iran, Brazil, and various proxy providers. The login succeeded. Nobody noticed.Russialockout, no MFA. A local admin account fell to credential stuffing from a rotating set of IPs across Russia, Iran, Brazil, and various proxy providers. The login succeeded. Nobody noticed.