“Advanced” Intrusion Targeting Critical Marketing Research Company

In early 2025 Huntress responded to a targeted intrusion against a global market research firm suspected to be state‑aligned espionage. The attacker used living‑off‑the‑land techniques, created a service named "WebrootCheck" to run c:\temp\1.bat, executed commands that changed registry keys (HKLM\System\CurrentControlSet\Control\Lsa DisableRestrictedAdmin and HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest UseLogonCredential) to enable credential dumping, and deployed a Go-based loader and Mesh Agent RAT (web.exe) which connected to an IP associated with Kaopu Cloud (AS138915). Huntress provided Sigma rules and hunting guidance to detect Mesh Central client activity and nslookup-based mail server enumeration.