Academy network attack COMPROMISES The Academy
The attack compromised and destroyed The Academy’s network infrastructure.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam had obliterated the Academy’s whole infrastructure”
Incident
incident:academy_network_attack
Destructive cyber incident in which Adam accessed the Academy’s cloud administration, VPN, internal systems and servers, wiped infrastructure and backups, and attempted to wipe connected mobile devices.
Destructive cyber incident in which Adam accessed the Academy’s cloud administration, VPN, internal systems and servers, wiped infrastructure and backups, and attempted to wipe connected mobile devices.
“Adam had obliterated the Academy’s whole infrastructure”
“The backups were completely wiped as well.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | The Academy | Explicit | 113 |
| outgoing | INITIAL_ACCESS_VIA | Office 365 | Derived | 113 |
| outgoing | INVOLVES | VPN | Explicit | 113 |
| outgoing | INVOLVES | lateral movement | Explicit | 113 |
| outgoing | INVOLVES | mobile device wipe | Explicit | 113 |
| outgoing | INVOLVES | destructive data wiping | Explicit | 113 |
| outgoing | INVOLVES | Domain controller | Explicit | 113 |
| outgoing | INVOLVES | backup server | Explicit | 113 |
| outgoing | INVOLVES | hypervisor | Explicit | 113 |
| outgoing | INVOLVES | log and evidence evasion | Explicit | 113 |
Academy network attack COMPROMISES The Academy
The attack compromised and destroyed The Academy’s network infrastructure.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam had obliterated the Academy’s whole infrastructure”
Academy network attack INITIAL_ACCESS_VIA Office 365
The attack initially gained access through the Academy’s Office 365 administrator account.
Derived Confidence 96% · Jack Rhysider EP 113 Details
“He was logged into the school’s admin portal on Office 365.”
Academy network attack INVOLVES VPN
The attack involved gaining VPN access to the Academy’s internal network.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He successfully VPNs into the school’s network”
Academy network attack INVOLVES lateral movement
The attack involved lateral movement across multiple Academy systems and servers.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“What he’s doing is a classic example of lateral movement”
Academy network attack INVOLVES mobile device wipe
The attack included an attempt to wipe 2,947 mobile devices connected to the Academy’s Office 365 environment.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“Adam had just attempted to wipe 2,947 devices”
Academy network attack INVOLVES destructive data wiping
The attack involved wiping servers, domain controllers, backups, and other infrastructure.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“the process of wiping the entire servers that I was on”
Academy network attack INVOLVES Domain controller
The attack involved running a destructive wipe command against a domain controller.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“I ran that on I think the domain controller.”
Academy network attack INVOLVES backup server
The attack involved wiping the Academy’s backup and secondary backup servers.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“There was a backup server and a secondary backup server”
Academy network attack INVOLVES hypervisor
The attack reached a hypervisor hosting the network’s backups, which were then wiped.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“it was a hypervisor, basically”
Academy network attack INVOLVES log and evidence evasion
Adam attempted to cover his tracks by deleting logs and other evidence, although he could not access the firewall logs.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“let’s try and get rid of as much as possible to try and cover my tracks”