Security operations, Unified.

GlobalTech Industries suffered a targeted intrusion beginning May 15 2026 via a spear-phishing email carrying a malicious Excel macro. The macro spawned a PowerShell stager that downloaded and executed a Cobalt Strike beacon (svchost32.exe), establishing C2 to 185.220.101.47. The attacker moved laterally to the domain controller (DC01) using PsExec, executed Mimikatz to dump domain administrator credentials, then spread to the file server (FS01) and web server (WEB01).

Approximately 2.3 GB of files were staged and a partial HTTPS exfiltration to the C2 succeeded on May 18. A ransomware payload (encrypt.exe) was deployed on May 19 but blocked by the EDR on all three targets. No evidence of ransomware execution was found. Incident containment actions are in progress.

On the morning of May 15 2026, a threat actor began probing GlobalTech's internet-facing web server, exploiting two unpatched vulnerabilities to gain an initial foothold. Less than an hour later, an employee in the finance department opened what appeared to be a routine vendor invoice emailed that morning. The attachment was malicious: opening it quietly launched hidden software that reached out to the attacker's server on the internet and installed a remote-control program on the employee's computer.

Over the next day the attacker used that foothold to move deeper into the network. They stole the passwords of several powerful administrator accounts directly from the domain controller's memory, then used those credentials to spread to the file server and a second server. Shortly after seizing administrative control, the attacker deliberately erased the security logs on the domain controller and switched off the company's security monitoring software — going dark for roughly sixteen hours to hide what they did next.

On May 17 the attacker gathered sensitive files from the finance share, compressed them into a password-protected archive, and the following night attempted to smuggle the data out. A first attempt was blocked by the firewall, but a second route succeeded and roughly 847 MB of finance data left the network before the connection was cut off.

Finally, on May 19, the attacker tried to deploy ransomware across three servers to encrypt the company's files. The endpoint security software detected and stopped the ransomware within seconds on every machine, so no files were encrypted. The investigation is ongoing.