================================================================================ AFFECTED SYSTEMS INVENTORY — OPERATION SHADOW HARVEST Incident ID : IR-2026-0409-007 Last Updated : 2026-04-09T06:00:00Z ================================================================================ STATUS KEY: Compromise : CONFIRMED / SUSPECTED / CLEAN Containment: ISOLATED / MONITORING / NOT YET ================================================================================ SYSTEM 1: JUMP-BOX -------------------------------------------------------------------------------- Hostname : JUMP-01 IP Address : 10.10.4.20 Operating System: Ubuntu 22.04 LTS Role : SSH jump box / bastion host Business Unit : IT Infrastructure Compromise : CONFIRMED Evidence Found : - SSH brute-force succeeded at 01:07 UTC (auth.log) - Backdoor beacon found at /tmp/.hidden/beacon - SSH scanning script at /var/tmp/.cache/ssh_scan.sh - Outbound connection attempts to 185.220.101.34:4443 (blocked by FW) - bash_history shows credential harvesting commands - Unauthorized use of svc-backup account credentials Containment : ISOLATED Isolation Time : 2026-04-09T02:30:00Z Notes : Initial point of entry. Attacker used compromised SSH credentials (likely from prior breach or credential stuffing). Disk image captured before isolation. ================================================================================ SYSTEM 2: WEB-SVR-01 -------------------------------------------------------------------------------- Hostname : WEB-SVR-01 IP Address : 10.10.2.50 Operating System: Windows Server 2022 Role : IIS web server (customer portal) Business Unit : Web Services Compromise : CONFIRMED Evidence Found : - CVE-2024-21887 exploit leveraged from JUMP-01 - Encoded PowerShell execution from w3wp.exe (IIS) - Mimikatz executed — credential dump of local SAM and cached domain creds - da-jthompson domain admin credentials harvested - Event logs cleared (Security, System, Application) at 03:10 UTC - SMB scanning to 10.10.3.x subnet observed Containment : ISOLATED Isolation Time : 2026-04-09T02:45:00Z Notes : Pivot point for lateral movement. Attacker exploited unpatched VPN/web vulnerability. IIS access logs partially recoverable from SIEM. Memory dump captured before isolation. ================================================================================ SYSTEM 3: DB-PRIMARY -------------------------------------------------------------------------------- Hostname : DB-PRIMARY IP Address : 10.10.3.15 Operating System: Windows Server 2019 Role : Primary SQL Server database (customer records) Business Unit : Data Services Compromise : CONFIRMED Evidence Found : - svc_update.exe (Cobalt Strike beacon) deployed via PsExec from WEB-SVR-01 - Malicious service "WindowsUpdateSvc" created for persistence - Active C2 callback to 91.215.85.142:443 - SQL database export (2.3 GB) exfiltrated to 198.51.100.77:8443 - Lateral movement to DC-01 using stolen da-jthompson credentials - procdump64.exe found — likely used for LSASS dumping Containment : ISOLATED Isolation Time : 2026-04-09T03:00:00Z Notes : Critical asset. Contains customer PII (est. 12,000+ SSN records confirmed exfiltrated). Data breach notification requirements triggered. Forensic image in progress. ================================================================================ SYSTEM 4: DC-01 -------------------------------------------------------------------------------- Hostname : DC-01 IP Address : 10.10.1.2 Operating System: Windows Server 2022 Role : Primary domain controller (Active Directory) Business Unit : IT Infrastructure Compromise : CONFIRMED Evidence Found : - Authenticated with stolen da-jthompson credentials from DB-PRIMARY - Scheduled task "SystemHealthCheck" created for persistence (healthchk.exe) - Run key persistence (HealthMonitor) added to registry - Sticky Keys backdoor installed (sethc.exe → cmd.exe) - DNS tunneling to c2-relay.darkcloud-services.net (340+ TXT queries) - Rogue domain admin account 'svc-healthmon' created - payload.dll found in System32 (under analysis) - PII data exfiltrated via HTTPS to 91.215.85.142 Containment : ISOLATED Isolation Time : 2026-04-09T03:15:00Z Notes : Highest-value target compromised. Full domain compromise assumed. All domain credentials should be rotated. KRBTGT password double-reset required. Secondary DC (DC-02) has been promoted to FSMO role holder during containment. ================================================================================ SYSTEM 5: FILE-SVR-01 -------------------------------------------------------------------------------- Hostname : FILE-SVR-01 IP Address : 10.10.3.20 Operating System: Windows Server 2022 Role : File server (finance, HR, legal shares) Business Unit : Shared Services Compromise : SUSPECTED Evidence Found : - svc_update.exe process detected enumerating file shares - 45,000 files catalogued across finance$, hr-docs$, legal$ shares - Process running as rogue account svc-healthmon - No encryption activity detected (ransomware staging only) - No confirmed data exfiltration from this host Containment : ISOLATED Isolation Time : 2026-04-09T04:50:00Z Notes : Ransomware detonation was likely imminent. Isolation prevented encryption. Full forensic analysis pending. File integrity checksums being compared against last known-good backup. ================================================================================ SYSTEM 6: WKSTN-FIN-03 -------------------------------------------------------------------------------- Hostname : WKSTN-FIN-03 IP Address : 10.10.5.30 Operating System: Windows 11 Enterprise 23H2 Role : Finance analyst workstation Business Unit : Finance Compromise : SUSPECTED Evidence Found : - Outbound Tor connection to 104.244.76.13:9001 - Suspicious user agent in proxy logs (IE 8 / Updater/1.0) - Phishing email with macro attachment received 2026-04-07 - Browser history includes update-service.legit-cdn.cloud - No malware detected by EDR scan (possible evasion or false lead) Containment : MONITORING Isolation Time : N/A (enhanced monitoring applied 2026-04-09T04:00:00Z) Notes : May be unrelated to main incident or may represent a separate initial access vector via phishing. User interviewed — denies intentional Tor use. Forensic imaging scheduled. ================================================================================ SYSTEM 7: DB-REPLICA -------------------------------------------------------------------------------- Hostname : DB-REPLICA IP Address : 10.10.3.16 Operating System: Windows Server 2019 Role : SQL Server read replica (reporting) Business Unit : Data Services Compromise : CLEAN (pending verification) Evidence Found : - SMB connection attempt from WEB-SVR-01 logged at 01:35 UTC - Connection was brief (< 2 seconds) — likely port scan only - No malicious files, processes, or persistence mechanisms found - EDR telemetry clean for entire incident window - All service accounts show normal authentication patterns Containment : MONITORING Isolation Time : N/A (enhanced monitoring applied 2026-04-09T03:30:00Z) Notes : SMB probe suggests attacker scanned this host but did not successfully compromise it. Continue monitoring for 30 days. Full vulnerability scan completed — no critical findings. ================================================================================ SYSTEM 8: BACKUP-SVR -------------------------------------------------------------------------------- Hostname : BACKUP-SVR IP Address : 10.10.1.5 Operating System: Ubuntu 20.04 LTS Role : Backup server (Veeam Backup & Replication) Business Unit : IT Infrastructure Compromise : CLEAN (pending verification) Evidence Found : - svc-backup account credentials were stolen (used on JUMP-01) - No unauthorized logins to BACKUP-SVR itself detected - All Veeam backup jobs completed normally during incident window - Filesystem integrity check (AIDE) shows no modifications - No outbound connections to any known IOC addresses Containment : MONITORING Isolation Time : N/A (enhanced monitoring applied 2026-04-09T03:00:00Z) Notes : svc-backup credentials must be rotated immediately. Backup integrity critical for recovery phase. Offline backup copies verified intact. Air-gapped backup from 2026-04-08 confirmed clean and available for restore. ================================================================================ SUMMARY Total Systems Assessed : 8 Confirmed Compromised : 4 (JUMP-01, WEB-SVR-01, DB-PRIMARY, DC-01) Suspected Compromised : 2 (FILE-SVR-01, WKSTN-FIN-03) Clean (Pending Verify) : 2 (DB-REPLICA, BACKUP-SVR) Isolated : 5 Under Monitoring : 3 ================================================================================