Investigating Intrusions From Intriguing Exploits

Huntress detected and contained exploitation of a zero‑day in GoAnywhere MFT that led to retrieval and attempted execution of a signed Truebot DLL (gamft.dll); analysts recovered file hashes, C2 domain (qweastradoc.com) and host IPs, mapped TTPs (certutil, rundll32, scheduled tasks) and linked the activity to the Silence/Truebot ecosystem and TA505 with likely ransomware intent.