Live engagement · INC-2291
Credential theft → lateral movement
Logistics client · 2,300 endpoints · 3 sites
Window T+00:38 → 01:10
- svc-backup disabled and every ticket it held revoked.
- 14 hosts isolated at the switch port, not only in the EDR agent.
- Outbound beacon to the command server sinkholed at the edge.
- Re-entry attempt over VPN refused — MFA fatigue push denied by on-call.
- Hosts isolated
- 14 / 14
- Attacker dwell
- 3 h 12 m
- Egress after 03:22
- 0 MB