================================================================================
  AFFECTED SYSTEMS INVENTORY — OPERATION SHADOW HARVEST
  Incident ID : IR-2026-0409-007
  Last Updated : 2026-04-09T06:00:00Z
================================================================================

STATUS KEY:
  Compromise : CONFIRMED / SUSPECTED / CLEAN
  Containment: ISOLATED / MONITORING / NOT YET

================================================================================

SYSTEM 1: JUMP-BOX
--------------------------------------------------------------------------------
  Hostname       : JUMP-01
  IP Address     : 10.10.4.20
  Operating System: Ubuntu 22.04 LTS
  Role           : SSH jump box / bastion host
  Business Unit  : IT Infrastructure
  Compromise     : CONFIRMED
  Evidence Found :
    - SSH brute-force succeeded at 01:07 UTC (auth.log)
    - Backdoor beacon found at /tmp/.hidden/beacon
    - SSH scanning script at /var/tmp/.cache/ssh_scan.sh
    - Outbound connection attempts to 185.220.101.34:4443 (blocked by FW)
    - bash_history shows credential harvesting commands
    - Unauthorized use of svc-backup account credentials
  Containment    : ISOLATED
  Isolation Time : 2026-04-09T02:30:00Z
  Notes          : Initial point of entry. Attacker used compromised SSH
                   credentials (likely from prior breach or credential stuffing).
                   Disk image captured before isolation.

================================================================================

SYSTEM 2: WEB-SVR-01
--------------------------------------------------------------------------------
  Hostname       : WEB-SVR-01
  IP Address     : 10.10.2.50
  Operating System: Windows Server 2022
  Role           : IIS web server (customer portal)
  Business Unit  : Web Services
  Compromise     : CONFIRMED
  Evidence Found :
    - CVE-2024-21887 exploit leveraged from JUMP-01
    - Encoded PowerShell execution from w3wp.exe (IIS)
    - Mimikatz executed — credential dump of local SAM and cached domain creds
    - da-jthompson domain admin credentials harvested
    - Event logs cleared (Security, System, Application) at 03:10 UTC
    - SMB scanning to 10.10.3.x subnet observed
  Containment    : ISOLATED
  Isolation Time : 2026-04-09T02:45:00Z
  Notes          : Pivot point for lateral movement. Attacker exploited
                   unpatched VPN/web vulnerability. IIS access logs partially
                   recoverable from SIEM. Memory dump captured before isolation.

================================================================================

SYSTEM 3: DB-PRIMARY
--------------------------------------------------------------------------------
  Hostname       : DB-PRIMARY
  IP Address     : 10.10.3.15
  Operating System: Windows Server 2019
  Role           : Primary SQL Server database (customer records)
  Business Unit  : Data Services
  Compromise     : CONFIRMED
  Evidence Found :
    - svc_update.exe (Cobalt Strike beacon) deployed via PsExec from WEB-SVR-01
    - Malicious service "WindowsUpdateSvc" created for persistence
    - Active C2 callback to 91.215.85.142:443
    - SQL database export (2.3 GB) exfiltrated to 198.51.100.77:8443
    - Lateral movement to DC-01 using stolen da-jthompson credentials
    - procdump64.exe found — likely used for LSASS dumping
  Containment    : ISOLATED
  Isolation Time : 2026-04-09T03:00:00Z
  Notes          : Critical asset. Contains customer PII (est. 12,000+ SSN
                   records confirmed exfiltrated). Data breach notification
                   requirements triggered. Forensic image in progress.

================================================================================

SYSTEM 4: DC-01
--------------------------------------------------------------------------------
  Hostname       : DC-01
  IP Address     : 10.10.1.2
  Operating System: Windows Server 2022
  Role           : Primary domain controller (Active Directory)
  Business Unit  : IT Infrastructure
  Compromise     : CONFIRMED
  Evidence Found :
    - Authenticated with stolen da-jthompson credentials from DB-PRIMARY
    - Scheduled task "SystemHealthCheck" created for persistence (healthchk.exe)
    - Run key persistence (HealthMonitor) added to registry
    - Sticky Keys backdoor installed (sethc.exe → cmd.exe)
    - DNS tunneling to c2-relay.darkcloud-services.net (340+ TXT queries)
    - Rogue domain admin account 'svc-healthmon' created
    - payload.dll found in System32 (under analysis)
    - PII data exfiltrated via HTTPS to 91.215.85.142
  Containment    : ISOLATED
  Isolation Time : 2026-04-09T03:15:00Z
  Notes          : Highest-value target compromised. Full domain compromise
                   assumed. All domain credentials should be rotated. KRBTGT
                   password double-reset required. Secondary DC (DC-02) has
                   been promoted to FSMO role holder during containment.

================================================================================

SYSTEM 5: FILE-SVR-01
--------------------------------------------------------------------------------
  Hostname       : FILE-SVR-01
  IP Address     : 10.10.3.20
  Operating System: Windows Server 2022
  Role           : File server (finance, HR, legal shares)
  Business Unit  : Shared Services
  Compromise     : SUSPECTED
  Evidence Found :
    - svc_update.exe process detected enumerating file shares
    - 45,000 files catalogued across finance$, hr-docs$, legal$ shares
    - Process running as rogue account svc-healthmon
    - No encryption activity detected (ransomware staging only)
    - No confirmed data exfiltration from this host
  Containment    : ISOLATED
  Isolation Time : 2026-04-09T04:50:00Z
  Notes          : Ransomware detonation was likely imminent. Isolation
                   prevented encryption. Full forensic analysis pending.
                   File integrity checksums being compared against last
                   known-good backup.

================================================================================

SYSTEM 6: WKSTN-FIN-03
--------------------------------------------------------------------------------
  Hostname       : WKSTN-FIN-03
  IP Address     : 10.10.5.30
  Operating System: Windows 11 Enterprise 23H2
  Role           : Finance analyst workstation
  Business Unit  : Finance
  Compromise     : SUSPECTED
  Evidence Found :
    - Outbound Tor connection to 104.244.76.13:9001
    - Suspicious user agent in proxy logs (IE 8 / Updater/1.0)
    - Phishing email with macro attachment received 2026-04-07
    - Browser history includes update-service.legit-cdn.cloud
    - No malware detected by EDR scan (possible evasion or false lead)
  Containment    : MONITORING
  Isolation Time : N/A (enhanced monitoring applied 2026-04-09T04:00:00Z)
  Notes          : May be unrelated to main incident or may represent a
                   separate initial access vector via phishing. User
                   interviewed — denies intentional Tor use. Forensic
                   imaging scheduled.

================================================================================

SYSTEM 7: DB-REPLICA
--------------------------------------------------------------------------------
  Hostname       : DB-REPLICA
  IP Address     : 10.10.3.16
  Operating System: Windows Server 2019
  Role           : SQL Server read replica (reporting)
  Business Unit  : Data Services
  Compromise     : CLEAN (pending verification)
  Evidence Found :
    - SMB connection attempt from WEB-SVR-01 logged at 01:35 UTC
    - Connection was brief (< 2 seconds) — likely port scan only
    - No malicious files, processes, or persistence mechanisms found
    - EDR telemetry clean for entire incident window
    - All service accounts show normal authentication patterns
  Containment    : MONITORING
  Isolation Time : N/A (enhanced monitoring applied 2026-04-09T03:30:00Z)
  Notes          : SMB probe suggests attacker scanned this host but did
                   not successfully compromise it. Continue monitoring for
                   30 days. Full vulnerability scan completed — no critical
                   findings.

================================================================================

SYSTEM 8: BACKUP-SVR
--------------------------------------------------------------------------------
  Hostname       : BACKUP-SVR
  IP Address     : 10.10.1.5
  Operating System: Ubuntu 20.04 LTS
  Role           : Backup server (Veeam Backup & Replication)
  Business Unit  : IT Infrastructure
  Compromise     : CLEAN (pending verification)
  Evidence Found :
    - svc-backup account credentials were stolen (used on JUMP-01)
    - No unauthorized logins to BACKUP-SVR itself detected
    - All Veeam backup jobs completed normally during incident window
    - Filesystem integrity check (AIDE) shows no modifications
    - No outbound connections to any known IOC addresses
  Containment    : MONITORING
  Isolation Time : N/A (enhanced monitoring applied 2026-04-09T03:00:00Z)
  Notes          : svc-backup credentials must be rotated immediately.
                   Backup integrity critical for recovery phase. Offline
                   backup copies verified intact. Air-gapped backup from
                   2026-04-08 confirmed clean and available for restore.

================================================================================
  SUMMARY
  Total Systems Assessed : 8
  Confirmed Compromised  : 4 (JUMP-01, WEB-SVR-01, DB-PRIMARY, DC-01)
  Suspected Compromised  : 2 (FILE-SVR-01, WKSTN-FIN-03)
  Clean (Pending Verify) : 2 (DB-REPLICA, BACKUP-SVR)
  Isolated               : 5
  Under Monitoring       : 3
================================================================================
