Double Extortion Attack Analysis

**Executive summary:** ReliaQuest investigated a double-extortion ransomware incident that began with presumed exploitation of NetScaler CVE-2023-3519, followed by lateral movement using Impacket, staging in c:\windows\debug, DLL sideloading of a signed Palo Alto Cortex XDR binary to load a malicious DLL, in-memory C2 (Cobalt Strike), exfiltration via a renamed Rclone to Dropbox, and defense impairment via a signed but vulnerable IObit driver (BYOVD) to disable EDR; the report includes IOCs and mitigation recommendations.