↓ Skip to main content
bubka hacks stuff

AdFind

ELK-BumbleBee - GOLD CABIN

ELK SOC SIEM Log Analysis BumbleBee GOLD CABIN Conti Ransomware Phishing ISO LNK Process Injection Credential Dumping Lsass ProcDump PsExec AdFind AnyDesk
An employee at CompliantSecure received a phishing email from emkei.cz, downloaded a malicious ISO containing BumbleBee loader 23.dll, which established C2 to 3.68.97.124 and injected into ImagingDevices.exe, dumped LSASS credentials, laterally moved to DC01 via PsExec using markw credentials, staged AdFind and AnyDesk, created sql_admin backdoor account, moved to FileServer01 and Support01, exfiltrated archived share data, and deployed Conti ransomware dropping R3ADM3.txt ransom notes.