Use Cases

The Challenge: Reducing Damage From a Delayed Ransomware Response Ransomware-related damage can escalate quickly when defenders cannot determine what is happening and where to act first. A delayed initial response gives attackers more time to disable defenses and move through connected systems. To respond earlier, teams need evidence that shows whether the threat is present in their own environment and where follow-up should begin. The Solution: Turning Ransomware Findings Into Action We examine ransomware incidents and malware samples to turn technical findings into operational evidence. The CrazyHunter attacks against healthcare organizations in Taiwan provide one concrete example of how this work can support teams beyond the initially affected organizations. Reveal the attack path through TTPs Our sample and campaign analysis identified that the attackers used a vulnerable driver, zam64.sys , in conjunction with the BYOVD technique to terminate the EDR protection. It also showed how the attackers used AD Group Policy, including SharpGPOAbuse, to distribute the ransomware. Validate exposure with IoCs We compiled malware and IoCs associated with the case. Our MDR team compared them with endpoint reports and activity records from customer environments under our monitoring. The Outcome: Verified Exposure Status and Quick Response The review resolved the immediate exposure question for monitored customers, while the case evidence established a basis for follow-up if related activity later appeared. Confirmed exposure status The MDR review found no signs of related ransomware activity in the monitored customer environments at the time. Customers therefore received a current assessment grounded in their own endpoint and activity data. Faster initial response By integrating threat intelligence into MDR and incident response, security teams can pinpoint threats faster and shift initial response efforts earlier using IoC deployment and TTP-based investigations. This proactive approach enables early identification and containment of ransomware actors before they can move laterally or execute widespread encryption, ultimately minimizing operational damage while significantly improving overall response accuracy.

The Challenge: Managing Product Risk and Darknet Exposure A leading equipment manufacturer of networking equipment and consumer electronics needed to manage two distinct areas of exposure. Unpatched vulnerabilities could put products at risk once attackers began exploiting them, while leaked employee credentials or company mentions on darknet forums could reveal risks affecting the wider organization. These needs drew on separate intelligence sources, which complicated analysis and made it harder for the team to work from a consolidated view of the findings. The Solution: Applying Specialized Intelligence in One Analysis Environment ThreatVision addressed each risk area with specialized intelligence and made the resulting findings available for centralized analysis. Prioritize vulnerabilities under active exploitation Vulnerability Insights Reports explained critical vulnerabilities and related attack scenarios. Patch Management Reports added exploitation status and patch guidance, helping the team determine which flaws required earlier remediation. Monitor company-related darknet exposure Deep & Dark Web Risk Monitoring identified leaked employee credentials and company mentions across darknet forums. The team could then assess the relevance and potential impact of those findings. Centralize findings from multiple sources API integration made vulnerability and darknet findings from ThreatVision available in OpenCTI, allowing the team to analyze them within the same environment. The Outcome: Improving Product Security and Intelligence Analysis With ThreatVision, the manufacturer gained a more consistent way to act on product vulnerabilities and company-related exposure. Focused product remediation. Exploitation evidence showed which vulnerabilities required priority attention, supporting earlier action on flaws already being exploited in the wild. Greater visibility into company-related exposure. Within six months, the team identified more than 300 leaked records and evidence of darknet discussions involving the organization. Streamlined intelligence analysis. OpenCTI integration reduced the need to reconcile findings across separate sources, giving the team a consolidated basis for follow-up.

The Challenge: Understanding State-Level APT Activity for Executive Reporting APAC government agencies responsible for sensitive data and critical infrastructure are frequent targets of nation-state-backed APTs. For this agency, keeping pace with advanced and evolving threats required actionable intelligence that could support immediate response and longer-term security planning. The security team needed a clearer view of who was behind the activity, how the threat groups were operating, and what they were targeting. Those findings then had to be translated into executive reporting that showed which developments mattered most to the organization. The Solution: Turning APT Intelligence Into Reporting Priorities ThreatVision gave the agency a structured way to apply different forms of intelligence to its reporting and review needs. Build rapid responses of new incidents Flash Reports provided concise updates on newly observed APT incidents, helping the agency determine which developments required further attention. Develop longer-term threat insight Monthly Reports tracked APT developments over time, while Cyber Affairs Reports added policy and geopolitical context. Together, they helped the agency understand how threats were evolving and assess their strategic implications. Analyze threat groups and anticipate activity Campaign Tracking Reports and Threat Landscape Reports examined attacker groups, their tactics, and target scope. This helped the agency anticipate relevant threats and strengthen defense planning. Align monitoring with relevant threats IoCs provided through ThreatVision gave the team concrete indicators to align monitoring with the threats covered in its reporting. The Outcome: Connecting Executive Priorities With Operational Follow-Through With ThreatVision, the agency established a clearer link between executive communication and the monitoring and preparedness activities that followed. More focused executive reporting. Updates centered on the developments most relevant to the organization, clarifying which risks required attention. Stronger shared threat awareness. Leadership and security teams had a common view of the threats under review, supporting more consistent internal discussion. Aligned operational priorities. The issues highlighted for leadership also informed incident response, business continuity planning, and risk review.

Challenges When an enterprise or organization faces a destructive cyber attack, time is of the essence in order to be able to respond and recover from it. If the attacker group can be detected at an early stage when they have infiltrated the victim organization's network, there is still a chance to effectively block the attacker group's behavior immediately, with less impact on the enterprise or organization. However, the more serious situation that enterprises currently face is that they fail to detect cyber threats in the early stages of attackers' infiltration, or even discover them only after data has been stolen or the system has been damaged. When organizations lack the deployment of endpoint protection tools, ransomware attackers are likely to spread rapidly from the initial access point, encrypting other related systems and hundreds or thousands of important files, shutting down the business. This also makes enterprises facing more and more challenges to quickly recover from ransomware attacks and avoid business interruption caused by damaged networks. How can enterprises or organizations respond to ransomware effectively? Through the following sharing of the case in which TeamT5 assists enterprises and organizations in cybersecurity incidents you may learn how to strengthen cybersecurity defense, not only prevent malicious attacks, but also minimize the losses caused by cyber threats. Detect intrusions and respond quickly TeamT5 received a notification from an information technology company in Taiwan on July 18 that important service hosts in the network environment were subject to encryption and ransomware, and ransomware information was displayed on the desktop of the VM environment. Upon receiving this notification, the TeamT5 Cybersecurity Incident Response Team (CSIRT) grasped the critical time for incident response and took the following actions as soon as possible: Interviewed clients and clarified needs and case status The incident response team directly held an emergency meeting with the client, clarified the client's needs through interviews, and the current situation of the site being hacked: the VM environment of the ESXi host in the site was encrypted, and ransomware information was displayed on the desktop in the VM environment . Provide attack-related information for clients to evaluate and make decisions The TeamT5 team has more than 20 years of experience in cyber threat research. It immediately assists clients in interpreting the received ransomware information, confirms the ransomware group and other related information, and provides clients with the suggestions in decision-making process. Provide suggestions of blocking attackers’ control and proliferation countermeasures In order to prevent other digital assets from being affected by the attack, the TeamT5 team provides countermeasures to block the attack, including network equipment disconnection and forensics, isolated endpoint scan, system backup and other emergency response measures. Before the root cause of the incident is clarified, it is recommended that relevant network equipment and systems should not connect to the Internet nor enable network communications to prevent attackers from entering the site again to cause damage. Collection of key evidence and customized response and investigation plan In addition to providing information such as field network system configuration, related equipment information and log status, TeamT5 also proposes an overall incident investigation plan. By deploying ThreatSonar, TeamT5's self-developed threat forensic and analysis platform, it can perform evidence collection and forensic analysis on key hosts, and also confirm the cybersecurity posture of other hosts in the VM environment. The scan results found that five hosts had high-risk (Level 5) threats and one host had medium-high risk (Level 4). The analysis included hacking tools, ransomware, suspicious accounts, IP sources, etc. Investigate the root cause of the incident and visualize the attack trajectory Based on the analysis of quick scan results of the field host and the network communication records, the TeamT5 team immediately carried out related investigation operations on the occurrence of the field incident, and grasped the attack time, tools and other details in detail as follows: Ransomware: Scanning analysis found that eight of the fourteen hosts were injected with ransomware. Injection location: C:\Documents and Settings\All Users"Start" menu\Programs\Startup\fast.exe Hacking Tools: Location: C:\WINDOWS\Temp\temp(mimikatz) Incident correlation: RDP login information: Source IP, Target User, Source Workstation (MONSTER), Logon Type 10 (RDP) Through threat hunting, lateral movement trajectories are visualized, allowing clients to clearly understand the root causes of incidents and carry out subsequent enhanced cybersecurity defense plans. Restore the pre-invasion environment and strengthen defenses to prevent similar attacks. After completing the incident investigation and identifying the root cause of the incident, TeamT5 works with the client to help confirm whether the following response actions to the cybersecurity incident have been implemented. Confirm endpoint cybersecurity posture First confirm that there is no running ransomware on the endpoint. You can try to start in the system safe mode. After removing the ransomware, use ThreatSonar to continuously scan other endpoints to confirm the cybersecurity status of the endpoint. Check network access policy Check the access rules for service hosts in the field to reduce the risk of attackers moving laterally. Confirm system account usage For accounts found to be exploited in the case, if they are not known accounts, they must be immediately deactivated and the account creation time must be confirmed; domain administrator and user passwords must be changed immediately, and AD reconstruction must be evaluated. Confirm the source of the attack It is found that the source of the attack in this incident is the firewall. It is recommended to confirm the status of the firewall device, update the version, and check the device access status. Learn from incidents to optimize long-term strategies for Cybersecurity defense TeamT5 provides a complete incident investigation report. In addition to detailing the root cause of the incident, hacker groups, attack methods, etc., it also provides targeted remedies and further practical suggestions for long-term cybersecurity defense: 1. Block the source of hacker control and reduce the risk of secondary hacking: Digital assets assessment: Confirm the security status of endpoints, grasp the security status of service interfaces that are exposed and may be attacked, and reduce the risk of being controlled by hackers, encrypted and extorted, causing service shutdown. Confirm the security of VPN equipment and systems: Based on the client's actual site environment, it is recommended to patch equipment vulnerabilities, prohibit multiple people from sharing accounts, and enable the two-stage verification mechanism and device verification mechanism to prevent attackers from gaining access and moving laterally to cause damage. Control network access management : When clients use Remote Desktop (RDP), if remote management is not implemented, it is recommended to strengthen the management interface and access control of important hosts to prevent attackers from accessing important hosts through internal hosts and encrypted ransomware. Improve personnel security awareness: You need to be security aware of phishing emails and website downloads to avoid account and password theft or execution of malicious programs. 2. Strengthen cybersecurity monitoring measures to detect abnormalities early: Endpoint detection and protection: It is not only necessary to rely on anti-virus software, but also to establish a terminal security defense mechanism to reduce the risk of threats such as malicious programs, encryption ransomware, and lateral movement. Enable event log: Enable event logs such as Event ID 4688 (program execution), Event ID 4625, 4624 (login audit), etc. AD and account authorization management: Confirm the usage of privileged accounts and general accounts to avoid password theft. Network communication policy settings: Confirm the systems or terminals allowed by the rules and their open connection settings to reduce the risk of access control threats. Check the server service log: Confirm whether there is any detection or attack situation, detect it in advance, handle it as soon as possible, and prevent intrusion detection. 3. Improve data backup and system restoration mechanisms to minimize hacker losses: Strengthen the 3-2-1 backup principle to ensure that normal operations can be restored when data is damaged or encrypted, and can prevent threats such as encryption blackmail and service shutdown. By reviewing the entire cybersecurity incident handling process and reviewing whether there are any areas that need to be strengthened, firstly, this can reduce the possibility of similar attacks happening again, and secondly, even if similar cybersecurity incidents are faced again in the future, they can be handled more effectively.

Challenges As hacker attack technology continues to evolve, advanced persistent threat (APT) techniques are becoming even more complex. More and more malicious programs are able to bypass EDR (Endpoint Detection and Response) and use legitimate tools to control endpoints. According to TeamT5's latest "APT Threat Landscape in APAC 2023" report , it is now common for hacker groups to use public or open source tools or exploit vulnerabilities of web servers to execute attacks. The report also pointed out that in the entire Asia-Pacific region, Taiwan, South Korea and Japan are the countries most targeted by APT actors. In Taiwan, the government, IT industry, education and critical infrastructure sectors are the main targets of attacks. The reason why APT actors are so interested in the IT sector is that these IT companies possess good channels or privileges to access big companies or government entities through supply chain attacks. To deal with endless APT attacks, how should enterprises or organizations effectively deal with them? The following case reveals how TeamT5 actually assists enterprise organizations to handle APT attacks. In this case, you may understand hacker attack techniques and how incident response measures reduce the losses to strengthen future cybersecurity defense. Since APT attacks are hidden and targeting specific enterprises, there are usually no obvious signs. Threats must be found through threat intelligence or EDR with APT detection capabilities. In a real case, a client used ThreatSonar, a threat forensic analysis platform developed by TeamT5, to conduct a scan of critical endpoints and analyze the scan results to understand whether there are potential threats. After inspection, it was gradually discovered that the hosts were installed with APT backdoors and Webshells. After receiving the detection report, TeamT5 immediately made further plans for the client, expanded scanning scope and analysis of endpoints in the field, and initiated the cybersecurity incident investigation service stage. TeamT5’s Cyber Security Incident Response Team (CSIRT) assists clients in accessing the situation and the attacker's possible intrusion methods, and provides clients with immediate suggestions to block the attacker's control and proliferation to avoid affecting other digital assets. In order to clarify the scope of attacks in the environment, TeamT5 helps clients take the following key actions: Key forensic analysis : Based on the circumstances of the case, the TeamT5 team identified the major compromised host. Per its operating system, forensic analysis by professional tools, and analysis of the network equipment communication log at the time of the incident, TeamT5 conducted incident-related investigations. Deploy endpoint scanning to identify the scope of attacks : By deploying ThreatSonar to perform endpoint scanning, it was found that the memory of a host hit the APT rule, triggering a high-risk (Level 5) threat alert. After analysis by TeamT5, it was confirmed that a backdoor program, a malicious threat, was placed into the memory along with threat information such as suspicious file paths and malicious C2 server lists. It is recommended that clients block malicious C2 servers and check whether the firewall has records of endpoints trying to connect to the servers. Based on the incident investigation report generated by ThreatSonar and network record analysis, the TeamT5 team performed correlation investigations of on-site incidents to understand the attackers’ path and root cause of the incident: Analysis of critical endpoints’ scan results : A malicious threat is found in the connection record of an executable file on the field host, and the malicious C2 domain of the threat information was hit. Incident investigation to find out the root cause : After identifying the risk host, investigation and analysis were initiated to find out the hacker control chain. From the correlation between the Web Log and the Event Log of the system with abnormal conditions, it was discovered that as early as half a year ago, the system had been implanted with a Webshell by attackers. After the attackers took advantage of the system vulnerability of the third-party service to gain control, they then used Softether and a set of Trojans to establish footholds. Further tracing back on the attack incident, we learned that the attacker abused PowerShell commands for execution by SQL permissions, and summarized the accounts that may have been controlled, as well as the IP information of attack source. Comprehensive assessment of the endpoints’ security status : In order to ensure the security status of endpoints in the site, the scanning scope was expanded. From the memory analysis, it was found that other on-site hosts were injected with the GhOst backdoor program. Introducing professional cybersecurity monitoring services to strengthen cybersecurity protection : TeamT5 Managed Detection and Response Services (MDR) provide clients with one-stop services such as threat monitoring, analysis, response, and investigation, reducing the burden of enterprise cybersecurity operations while achieving comprehensive risk control. To prevent similar incidents from happening again, TeamT5 provides clients with the following cyber defense suggestions: Block the sources of hacker control take complete review of the security status of digital assets, confirm VPN equipment and system vulnerability patching, strengthen access control of critical hosts, and improve personnel's security awareness of phishing emails or website downloaders. Strengthen monitoring and analysis measures establish an endpoint security monitoring mechanism to provide real-time alerts and block malicious behaviors; confirm the settings of network communication rules or the settings of terminal connections. Establish an incident response mechanism Develop incident response procedures for the high-risk incidents that may occur, including pre-compromise monitoring and analysis, mitigation during the incident, and subsequent recovery and improvement, etc., so that they can be followed when an incident occurs.

Challenges As we all know, hackers often use various network attack methods, such as zero-day attacks, phishing, brute force attacks, social engineering, malware, etc., in an attempt to gain system access and sensitive data. Then, the data is used to target enterprises, governments, or individuals. All these cyber threat events pose a major threat. Taking the leakage of personal information as an example, it causes people to lose money due to fraud and directly damages the reputation of enterprises. According to an IBM report[1], the global average cost of data breach reached USD $4.45 million in 2023, including operating losses, business shutdowns, remediation, legal fees and other expenses. These losses alone may be enough to bankrupt a small company. In addition, Harvard Business Review[2] pointed out that data leakage may lead to reduction in credit rating, the loss of competitive advantage, and expose the company to higher borrowing costs and financial risks. Therefore, how should companies or organizations effectively deal with cybersecurity incidents caused by malicious attacks? The following is a case in which TeamT5 actually assists companies and organizations in handling personal data breach. In this case, you may learn (1) how hackers obtain sensitive personal data through network attacks; (2) the emergency response measures required to deal with the incident; (3) how to reduce the losses caused by the incident threat to the minimum, and plan the defense priorities for future. If a personal information breach is discovered, we will quickly assist in handling it. When TeamT5 received the client's demand for cybersecurity incident handling - the company's information had been leaked, causing people to be defrauded, and important service hosts in the network environment had anti-virus alerts. After receiving the client's request, TeamT5 Cybersecurity Incident Response Team (CSIRT) interviewed the client to understand the case situation, grasped the WebShell and malicious program alarm information of the website host , and provided relevant incident analysis and handling suggestions: Interpret alarm information and determine possible causes The TeamT5 team has more than 20 years of experience in cyber threat research, and promptly assists clients in interpreting received alarms and determining possible intrusion routes for attackers. Provide response suggestions to control the spread of incidents In order to prevent other digital assets from being affected, the TeamT5 team recommends taking emergency response measures such as disconnecting network equipment for forensics, endpoint isolation scanning, and system backup analysis. Before the root cause of the incident is clarified, the device will not be able to access the Internet and network communications to prevent attackers from entering the site again to cause damage. If a system cannot be isolated offline due to business operation requirements, it is recommended to adopt the minimum access principle to limit the system to only connect to relevant hosts and control the scope of service access. Collection of key evidence, investigation analysis and planning In addition to the field network system configuration, related device information and log status provided by the client, TeamT5 also proposes a complete incident investigation plan by deploying TeamT5's self-developed threat forensic and analysis platform on the field host endpoint. ThreatSonar, coupled with professional forensic tool analysis, allows professional security incident investigators to confirm the security status of service hosts and other operating computers in the environment. Endpoint detection and analysis to understand the scope of attacks On the day of the incident, TeamT5 immediately assisted the client in taking the following key actions: Key forensic analysis: Based on the circumstances of the case, the TeamT5 team identified the host that may be the key incident, and used professional tools to conduct forensic analysis and network equipment communication records at the time of the incident for further investigation into incident correlation. Comprehensive scan of endpoints and list of compromised areas: ThreatSonar quickly scanned the security of hosts in the site and found that the host involved had high-risk (Level 5) threats. It analyzed the malicious threats that hit the APT detection rules, abnormal login events, suspicious file paths, and malicious relay station (C2) list and other threat information. ; Another host was detected to have malicious behaviors such as lateral movement and attackers using remote desktop services. Investigate the root cause of the incident and visualize the attack trajectory Based on the analysis of quick scan results of the field host and the network record analysis, the TeamT5 team performed related investigation operations on the occurrence of the field event, enabling them to understand the attack path and the root cause of the hack: Incident investigation and analysis: It was found that weak passwords (weak passwords) that are easily cracked were exploited on the website management page. Webshell was detected on the website. After inspection, it was found that the hacker uploaded the malicious web program to the target server through a vulnerability of file upload. At the same time, it was discovered that there was a leakage of relevant file information on the official website. Field evidence correlation: From the host event log, it was discovered that there were subsequent behaviors such as Powershell and lateral movement, and the accounts that may have been controlled and used were summarized, as well as the attack source IP information. Comprehensive investigation results: Through the visual summary of event trajectories, clients can understand the attack path of the incident and clearly understand how the attacker exploited the website's weaknesses and accessed the website's backend through different IPs, and then obtained a privileged account to have lateral movement. Block the source of the attack and restore the incident environment After completing the incident investigation and identifying the root cause of the hack, TeamT5 works with the client to help determine the relevant response actions required for the security incident: Confirm whether the security status of field endpoints is clean Through the endpoint security scanner, first confirm whether the endpoints in the field have malicious threatening behaviors, such as backdoors, hacking tools, lateral movement, etc., and then scan and confirm with anti-virus software, and then allow the endpoints to access the Internet one by one. Review whether network access rules are strict Check the rules for network management and general users in the domain to access the service host to prevent all hosts from being able to remotely log in to the service host, such as RDP, WinRM, SMB, Anydesk, etc., and block the risk of lateral movement of attackers. Confirm whether the system account permissions are appropriate For the exploited account, if it is not a known account, it must be deactivated immediately and the account creation time must be confirmed; in addition, if AD has been implanted with a backdoor or lateral movement, the domain administrator and user passwords must be changed immediately, Evaluate whether to rebuild AD. Confirm whether system vulnerabilities can be controlled Analyze and investigate system records such as websites, APs, and DBs to confirm whether there are malicious sources and behaviors, block the discovered malicious sources, and repair possible vulnerabilities. Analyze and investigate the connection source of the firewall and account usage, confirm the device status and update the version. You must ensure that the device is safe before going online for service. Review cybersecurity strategies and strengthen future defenses In order to prevent similar incidents from happening again, TeamT5 recommends that clients follow the US NIST Cybersecurity Framework and review the identification, protection, detection, response, recovery, etc. in the enterprise field. Five major aspects of defense: 1. Strengthen field system security (identification, detection, protection) Understand the configuration and operation of system endpoints in the field. Strengthen backend management accounts and restrict access sources. Control data access sources and restrict the use of dangerous pre-stored programs. Systems with files upload function need to have a malicious file detection and prevention mechanism. 2. Strengthen monitoring and analysis measures (identification, detection, protection) Import endpoint scanning and monitoring mechanism to provide real-time alerts and block malicious behaviors. Strengthen network behavior monitoring and system service record backup and analysis mechanisms. Establish a threat information output mechanism to detect suspicious threat sources and field weaknesses early. 3. Establish incident response mechanism (response & recovery) For the types of high-risk incidents that may occur (such as ransomware, personal data theft, APT intrusion, etc.), follow the NIST Incident Response Plan to establish an IR Playbook and formulate incident handling procedures (including pre-incident monitoring and analysis, mitigation and elimination during the incident, and post-incident recovery improvement, etc.) so that you can follow the instructions when an incident occurs. Reference [1] IBM: Cost of a Data Breach Report 2023 [2] Keman Huang, Xiaoqing Wang, William Wei, and Stuart Madnick, 2023, “The Devastating Business Impacts of a Cyber Breach,” Harvard Business Review [3] NIST Cybersecurity Framework [4] NIST Computer Security Incident Handling Guide