Incident
incident:jekhyde_and_carl_physical_penetration_engagement
Authorized physical security assessment of an international manufacturing facility involving social engineering and rogue-device placement.
Authorized physical security assessment of an international manufacturing facility involving social engineering and rogue-device placement.
“We were hired to do a physical for an international manufacturing business.”
“The objective is to break into this manufacturing plant... plant a rogue device... and get out.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | JekHyde | Explicit | 41 |
| outgoing | INVOLVES | Carl | Explicit | 41 |
| outgoing | INVOLVES | physical penetration testing | Explicit | 41 |
| outgoing | INVOLVES | social engineering | Explicit | 41 |
| outgoing | INITIAL_ACCESS_VIA | phishing | Derived | 41 |
| outgoing | INVOLVES | pretext | Explicit | 41 |
| outgoing | INVOLVES | lookalike domain | Explicit | 41 |
| outgoing | INVOLVES | RFID visitor badge | Explicit | 41 |
| outgoing | INVOLVES | rogue device | Explicit | 41 |
| outgoing | INVOLVES | credential interception | Explicit | 41 |
| outgoing | INVOLVES | domain administrator access | Explicit | 41 |
| outgoing | LEADS_TO | domain administrator access | Explicit | 41 |
JekHyde and Carl physical penetration engagement INVOLVES JekHyde
The engagement involved JekHyde as the physical penetration tester and social engineer.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“The team consists of JekHyde and Carl. Jek is a physical penetration tester.”
JekHyde and Carl physical penetration engagement INVOLVES Carl
The engagement involved Carl as the hardware and rogue-device specialist.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“The team consists of JekHyde and Carl.”
JekHyde and Carl physical penetration engagement INVOLVES physical penetration testing
The engagement was a permitted physical penetration test of a manufacturing facility.
Explicit Confidence 98% · Jack Rhysider EP 41 Details
“The objective is to break into this manufacturing plant”
JekHyde and Carl physical penetration engagement INVOLVES social engineering
The engagement used social engineering to obtain trusted access to the facility.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“A Red Team assessment.”
“we exploited the human factor”
JekHyde and Carl physical penetration engagement INITIAL_ACCESS_VIA phishing
The team obtained initial physical access through a targeted phishing and pretexting campaign that prompted an employee to invite them to the facility.
Derived Confidence 97% · Jack Rhysider EP 41 Details
“they’ve got someone inside inviting them in”
JekHyde and Carl physical penetration engagement INVOLVES pretext
The engagement involved impersonating corporate employees and constructing a charitable-work pretext.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“This is just to build up the pretext.”
JekHyde and Carl physical penetration engagement INVOLVES lookalike domain
The engagement involved a lookalike domain used in the targeted phishing email.
Explicit Confidence 99% · JekHyde EP 41 Details
“Instead of targetcompany.com it was targetcompany-communityresources.com.”
JekHyde and Carl physical penetration engagement INVOLVES RFID visitor badge
The team was issued RFID visitor badges after being admitted to the headquarters.
Explicit Confidence 99% · JekHyde EP 41 Details
“we were given visitor badges which were RFID visitor badges”
JekHyde and Carl physical penetration engagement INVOLVES rogue device
The engagement involved planting a rogue device in the company's network.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“The objective is to break into this manufacturing plant in a Spanish-speaking country, plant a rogue device”
JekHyde and Carl physical penetration engagement INVOLVES credential interception
The team recovered unencrypted credentials by monitoring traffic on the network and used them to pivot into multiple systems.
Explicit Confidence 99% · Carl EP 41 Details
“With sufficient amount of monitoring on the wire, credentials were recovered”
JekHyde and Carl physical penetration engagement INVOLVES domain administrator access
The engagement resulted in the team obtaining domain administrator access to the network.
Explicit Confidence 98% · Jack Rhysider EP 41 Details
“this team successfully got in, put the rogue device in, and gained full access to the network”
JekHyde and Carl physical penetration engagement LEADS_TO domain administrator access
Monitoring recovered credentials that enabled pivots into multiple systems and eventual escalation to domain administrator access.
Explicit Confidence 99% · Carl EP 41 Details
“credentials were recovered that allowed us to pivot into multiple systems and then we eventually escalated up to DA”