Identifying an Existing APT Intrusion

WatchGuard Threat Lab discovered and investigated an APT intrusion on a customer network in which attackers acquired valid local and domain accounts, attempted VBS/PowerShell-based payload delivery, executed PowerSploit and Cobalt Strike components for lateral movement and command-and-control, used PsExec and Mimikatz, and exfiltrated data to Dropbox via RClone; the report provides TTP mapping, IOCs (including an MD5), and recommendations such as MFA and robust EDR.