Incident
incident:the_d_r_incident
Also: Dominican Republic incident
Episode-named incident involving a coordinated campaign against Dominican Republic government organizations, critical infrastructure, and a bank.
Episode-named incident involving a coordinated campaign against Dominican Republic government organizations, critical infrastructure, and a bank.
“EP 135: The D.R. Incident”
“Over thirty government organizations were compromised by that campaign”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Quantum ransomware | Explicit | 135 |
| outgoing | INITIAL_ACCESS_VIA | phishing | Explicit | 135 |
| outgoing | INVOLVES | Fortinet firewall vulnerability | Explicit | 135 |
| outgoing | INVOLVES | Bandook | Explicit | 135 |
| outgoing | INVOLVES | Cobalt Strike | Explicit | 135 |
| outgoing | INVOLVES | Conti | Explicit | 135 |
| outgoing | ATTRIBUTED_TO | Russia | Uncertain | 135 |
| outgoing | ATTRIBUTED_TO | Dark Caracal | Uncertain | 135 |
| outgoing | INVOLVES | operational technology | Explicit | 135 |
The D.R. Incident INVOLVES Quantum ransomware
The Dominican Republic agricultural department suffered a ransomware attack attributed in the report to the Quantum ransomware group.
Explicit Confidence 98% · Host2 EP 135 Details
“The Dominican Republic’s agricultural department has suffered a ransomware attack by the Quantum ransomware group”
The D.R. Incident INITIAL_ACCESS_VIA phishing
The investigation found that the attackers entered the network through a phishing attack.
Explicit Confidence 99% · Omar Avilez EP 135 Details
“the attackers got into the network via a phishing attack”
The D.R. Incident INVOLVES Fortinet firewall vulnerability
The Quantum attackers exploited a Fortinet firewall vulnerability to obtain VPN access to the infrastructure.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“They exploited a vulnerability, a Fortinet firewall that allowed them to have VPN access to the infrastructure”
The D.R. Incident INVOLVES Bandook
Hundreds of phishing emails contained or used Bandook as the attackers' backdoor.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“all of them had a backdoor the attackers were using, which was a backdoor known as Bandook”
The D.R. Incident INVOLVES Cobalt Strike
A compromised system downloaded Cobalt Strike, and a later Cobalt Strike implant communicated with Conti's command-and-control infrastructure.
Explicit Confidence 99% · Jack Rhysider EP 135 Details
“a system did get infected and it reached out to the command and control server to download Cobalt Strike”
“they now downloaded or installed a second malware, which was a Cobalt Strike implant which was communicating to Conti’s C2”
The D.R. Incident INVOLVES Conti
The Dominican Republic campaign included Conti-related command-and-control activity and staged Conti ransomware, although the ransomware was stopped before execution.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“a Cobalt Strike implant which was communicating to Conti’s C2”
“they seemed to have stopped the Conti ransomware attack before it actually triggered ransomware on any systems”
The D.R. Incident ATTRIBUTED_TO Russia
Omar says his partners told him Russia was involved in the Dominican Republic campaign, but he also presents the attribution as uncertain and based on what they learned during the investigation.
Uncertain Confidence 72% · Omar Avilez EP 135 Details
“they told us that it was not just Dark Caracal; it was not just Conti, but also it was — Russia was also involved”
The D.R. Incident ATTRIBUTED_TO Dark Caracal
The campaign was associated with Dark Caracal in the investigation, but the episode emphasizes that attribution was not clear.
Uncertain Confidence 72% · Omar Avilez EP 135 Details
“it was not just Dark Caracal; it was not just Conti”
“This attribution wasn’t exactly clear”
The D.R. Incident INVOLVES operational technology
The campaign reached critical infrastructure, but the attackers could not disrupt the operational technology controlling it.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“They tried to but they could not. The critical infrastructure works — what we call the OT, which is operational technology”