VERA — Shift 6 in Review

Operational Handoff

**Shift window:** 2026-04-27 to 2026-05-01
**Cases investigated:** 6
**Pending ARIA action:** 6 cases — urgency breakdown: immediate: 6 | within_shift: 0 | next_available: 0
**On hold:** 0 cases pending additional telemetry
**Watch list:** Incoming shift and ARIA should prioritize the confirmed AsyncRAT campaign spanning VERA-20260429-0014 and VERA-20260501-0024 — same malware family, overlapping TTPs, shared accounts (a.patel, svc_backup), and an unidentified SIEM source IP (159.201.29.116) that may represent a third compromised asset not yet investigated.

Investigation Overview

**Cases investigated:** 6
**Verdicts:** ESCALATE_TO_ARIA: 6 | CLOSED: 0 | HOLD: 0
**Root cause confidence:** CONFIRMED: 6 | PROBABLE: 0 | UNDETERMINED: 0
**TORA hypothesis resolution:** CONFIRMED: 3 | REFINED: 3 | REFUTED: 0
**Parse failures:** 0
**Blast radius:** confirmed assets: 13 | probable assets: 4 | lateral movement: yes | crown jewels: affected

What TORA Handed Off

TORA delivered six dns_malicious_lookup cases across four days, all P1 or P2, covering three asset types — production workstations, a staging database server, and a production jump server that appeared twice across the shift window. Hypotheses were well-formed and specific on initial access mechanisms, identity context, and C2 domain attribution; in all six cases TORA’s direction was correct enough to anchor the investigation immediately rather than requiring reorientation. The primary weakness in TORA’s hypotheses was identity axis resolution — in three cases (VERA-20260427-0002, VERA-20260429-0014, VERA-20260501-0024) the executing account identified by endpoint telemetry differed from the account TORA flagged, suggesting TORA is anchoring on session presence rather than process-level user context. No ssh_bruteforce_c2_dns alert types were formally present in this queue, but concurrent SSH brute-force activity appeared as a secondary signal in four of six cases; in every instance the brute-force was a failed, separate campaign unconnected to the primary compromise vector, and those cases required materially less investigation time to resolve than the DNS C2 and tunneling cases where the initial access vector remained unknown and process tree reconstruction was necessary to establish confirmed disposition.

What the Investigations Found

CASE-20260427-0002 / VERA-20260427-0002 | dns_malicious_lookup | ESCALATE_TO_ARIA | CONFIRMED | REFINED Finding: ws-legal-077.corp.local is confirmed compromised by a Metasploit implant executing via a fully masqueraded process chain (firefox.exe in C:\Temp spawned by csrss.exe in C:\Windows\Temp spawned by svchost.exe in C:\Users\Public), with confirmed lateral movement attempt to high-criticality asset 10.10.5.102 via WMI/RDP at 16:47 UTC. Why it’s worth noting: This case surfaced two recurring data integrity issues — an IDS/netflow DNS response code discrepancy (NOERROR vs NXDOMAIN for fonts-static-cdn.net) and an SSH attacker IP inconsistency between TORA’s enrichment data (91.92.251.103) and raw auth logs (185.250.237.97) — that, if systemic, could degrade TORA’s attacker attribution accuracy and scope assessment logic across the pipeline.

CASE-20260428-0008 / VERA-20260428-0008 | dns_malicious_lookup | ESCALATE_TO_ARIA | CONFIRMED | CONFIRMED Finding: srv-jump-01.corp.local was compromised via SSH brute-force success (176.36.47.213/UA, 2,705 attempts, account deploy) followed by confirmed Remcos RAT deployment, with LSASS access (T1003.001), process injection (T1055), persistence via startup folder, and post-compromise svc-sysadmin (admin, no MFA) session activity confirming active credential harvesting on a production jump server. Why it’s worth noting: An LSASS memory access alert (IDS-679031) firing at 14:55 UTC — nearly two hours before the 18:48 UTC confirmed brute-force success — and a svc-sysadmin Kerberos authentication at 18:24 UTC from the host itself both predate the confirmed initial access event, indicating either a prior separate access vector or a materially longer dwell time than TORA’s 151-minute estimate captures.

CASE-20260429-0014 / VERA-20260429-0014 | dns_malicious_lookup | ESCALATE_TO_ARIA | CONFIRMED | REFINED Finding: srv-jump-01.corp.local is confirmed compromised by AsyncRAT — a trojanized bitsadmin.exe executing from C:\Temp under user alee (not svc-backup as TORA hypothesized) queried api-diag-collector.io via DNS TXT, wrote a HKCU run key for loader.dll within 30 seconds of the query, and spawned LOLBin children (mshta.exe, C:\Temp\wmic.exe), with post-query outbound connections to 43.70.42.59:8080 and 180.61.71.133:22 confirmed in netflow. Why it’s worth noting: TORA’s identity axis anchored on svc-backup as the likely executing account based on session presence, but EDR process-level user context identified alee as the actual actor — a repeating pattern this shift that suggests TORA’s identity enrichment logic is not consuming process-level user attribution pre-triage on multi-session hosts.

CASE-20260501-0024 / VERA-20260501-0024 | dns_malicious_lookup | ESCALATE_TO_ARIA | CONFIRMED | CONFIRMED Finding: ws-fin-015.corp.local (Ubuntu 22.04) is confirmed compromised by AsyncRAT — /var/tmp/explorer.exe executing under svc_backup, parented to /tmp/lsass.exe, with dual persistence mechanisms (scheduled task svc_tmp, startup folder update_vbs), four staging artifacts, a post-C2 python3 child process, and post-compromise Kerberos privilege escalation and NTLM account switch on a.patel’s session — directly expanding the confirmed AsyncRAT campaign from VERA-20260429-0014. Why it’s worth noting: A low-severity Process Injection Detected alert (IDS-998703) on the same host was closed at 17:23 UTC, three hours before C2 contact — the second case this shift where a prior closure on a high-criticality host preceded confirmed compromise, indicating a potential systematic under-triage of low-severity process injection signals on high-criticality assets.

Where Confidence Hit Its Ceiling

All six cases reached CONFIRMED disposition; however, network flows were absent in three cases (VERA-20260428-0008, VERA-20260428-0010, VERA-20260501-0024), preventing confirmation of active C2 channel establishment, outbound data volume, and lateral movement success on assets where endpoint evidence was otherwise conclusive. The specific recurring gap is netflow absence on what appears to be a shared network segment — all three affected hosts (srv-jump-01.corp.local, srv-db-staging.corp.local, ws-fin-015.corp.local) sit on corp-lan, suggesting a sensor coverage gap rather than isolated collection failures. Confirmed active C2 channel, exfiltration scope, and lateral movement success status in these cases would have been resolvable had netflow been present.

Patterns Across Cases

Process masquerading via LOLBin abuse (T1036, T1036.005) and non-standard executable paths appeared in five of six cases, consistently using world-writable locations (C:\Temp, C:\Windows\Temp, C:\Users\Public, /tmp/, /var/tmp/) as staging or execution directories for implants and second-stage payloads. The specific evidence pattern recurs across VERA-20260427-0002 (C:\Temp\firefox.exe), VERA-20260428-0008 (C:\Temp\loader.dll, C:\Users\Public\run.ps1), VERA-20260428-0010 (/bin/regsvr32.exe, /tmp/svchost.exe, /var/tmp/firefox.exe), VERA-20260429-0014 (C:\Temp\bitsadmin.exe, C:\Temp\wmic.exe), and VERA-20260501-0024 (/var/tmp/explorer.exe, /tmp/lsass.exe), all confirmed under T1036.005. At the campaign level, this pattern indicates either a shared initial access broker or a common staging playbook operating across multiple threat actors — the consistency of world-writable path selection and Windows binary name masquerading across both Windows and Linux hosts suggests tooling-level overlap rather than coincidental technique convergence.

For NOVA

**Alert type distribution:** dns_malicious_lookup: 6
**IDS/netflow DNS discrepancy:** 2 cases affected — VERA-20260427-0002 (NOERROR in IDS vs NXDOMAIN in netflow for fonts-static-cdn.net), VERA-20260429-0014 (TXT NOERROR vs A NXDOMAIN for api-diag-collector.io)
**Prior alert closure pattern:** 2 cases where prior closures preceded confirmed compromise — VERA-20260428-0010 (same_rule_count=2, prior alerts unactioned before case surfaced), VERA-20260501-0024 (IDS-998703 Process Injection Detected closed at 17:23 UTC, C2 contact confirmed at ~21:30 UTC)
**Recurring attacker IPs:** none confirmed across 2+ cases
**Recurring malware families:** AsyncRAT (VERA-20260429-0014, VERA-20260501-0024)
**Confirmed MITRE techniques (shift-wide):** T1036.005 (5 cases), T1078 (4 cases), T1547.001 (3 cases), T1055 (3 cases)
**Open question:** The shared use of world-writable staging paths and Windows binary name masquerading across both Windows and Linux hosts in five of six cases — combined with service account execution (svc_backup appearing in VERA-20260429-0014, VERA-20260430-0020, and VERA-20260501-0024) — suggests a common staging playbook; does longitudinal data across prior shifts reveal a consistent initial access broker or shared toolset upstream of the confirmed malware families?

For ARIA

**Escalations pending:** 6 cases
**Urgency breakdown:** immediate: 6 | within_shift: 0 | next_available: 0
**Immediate actions required:**
  - isolate_host: ws-legal-077.corp.local (10.10.2.77) — confirmed Metasploit implant, lateral movement attempt to 10.10.5.102
  - isolate_host: 10.10.5.102 — confirmed lateral movement destination from ws-legal-077, endpoint telemetry not yet collected
  - isolate_host: srv-jump-01.corp.local (10.10.3.21) — confirmed Remcos RAT + confirmed AsyncRAT, two separate intrusion events across shift
  - isolate_host: srv-db-staging.corp.local (10.10.5.7) — confirmed LOLBin implant with automated C2 beaconing
  - isolate_host: ws-mktg-042.corp.local (10.10.1.42) — confirmed dnscat2 DNS tunneling exfiltration, lateral movement to FILE-673, DEV-584, SERVER-931
  - isolate_host: ws-fin-015.corp.local (10.10.2.15) — confirmed AsyncRAT, dual persistence, active privilege escalation
  - block_ioc: api-diag-collector.io — AsyncRAT C2, confirmed in VERA-20260429-0014 and VERA-20260501-0024
  - block_ioc: cdn-metrics-pipe.io — dnscat2 C2, confirmed in VERA-20260430-0020
  - block_ioc: update-relay-svc.com — Remcos RAT C2, confirmed in VERA-20260428-0008
  - block_ioc: fonts-static-cdn.net — Metasploit C2, confirmed in VERA-20260427-0002
  - block_ioc: infra-edge-sync.net — fast-flux C2, confirmed in VERA-20260428-0010
  - block_ioc: 43.70.42.59:8080 — post-C2 outbound connection, VERA-20260429-0014
  - block_ioc: 180.61.71.133:22 — post-C2 outbound connection, VERA-20260429-0014
  - disable_account: svc-sysadmin — admin, no MFA, confirmed post-compromise use on srv-jump-01 (VERA-20260428-0008)
  - disable_account: svc_backup — service account, confirmed as implant executor in VERA-20260429-0014, VERA-20260430-0020, VERA-20260501-0024; provenance (legitimate vs attacker-created) unconfirmed
  - revoke_tokens: a.patel — admin session confirmed hijacked in VERA-20260430-0020 and VERA-20260501-0024; SSO token leverage from unexpected source IP 10.10.3.181 unresolved
  - disable_account: m.reyes — elevated-privilege session confirmed present during Metasploit compromise of ws-legal-077 (VERA-20260427-0002)
  - disable_account: alee — confirmed executing account for AsyncRAT on srv-jump-01 (VERA-20260429-0014); initial access vector unknown
  - disable_account: t.nguyen — confirmed Kerberos privilege escalation on srv-db-staging (VERA-20260428-0010), no business justification for presence on that host
**Cross-case coordination needed:**
  - AsyncRAT campaign — api-diag-collector.io C2, svc_backup executing account, a.patel session hijacking, and T1036.005 masquerading TTPs confirmed in both VERA-20260429-0014 (srv-jump-01) and VERA-20260501-0024 (ws-fin-015); containment and IOC blocking must be coordinated; unidentified SIEM source IP 159.201.29.116 querying telemetry-cloud-api.com at 20:44 UTC (VERA-20260501-0024) is a potential third compromised asset requiring immediate identification
  - svc_backup service account — appears as implant executor in VERA-20260429-0014, VERA-20260430-0020, and VERA-20260501-0024 across three different hosts; account provenance must be confirmed and all sessions terminated environment-wide
  - a.patel admin credentials — leveraged in VERA-20260430-0020 and VERA-20260501-0024; full credential invalidation and SSO token revocation must cover both cases simultaneously
  - Lateral movement destinations ws-mktg-042 → FILE-673, DEV-584, SERVER-931 — lateral movement confirmed within 33 minutes of dns tunneling event (VERA-20260430-0020); all three destinations require immediate endpoint investigation before isolation sequencing is finalized
**Credential exposure:** m.reyes (ws-legal-077, elevated privilege, VERA-20260427-0002) | local admin on ws-legal-077 (VERA-20260427-0002) | svc-sysadmin (srv-jump-01, admin, no MFA, VERA-20260428-0008) | deploy account (srv-jump-01, brute-forced, VERA-20260428-0008) | helpdesk01 (srv-jump-01, identity pivoting confirmed, VERA-20260428-0008) | t.nguyen (srv-db-staging, Kerberos escalation confirmed, VERA-20260428-0010) | alee (srv-jump-01, implant executor, VERA-20260429-0014) | a.patel (ws-mktg-042 and ws-fin-015, admin, SSO token leverage confirmed, VERA-20260430-0020 and VERA-20260501-0024) | svc_backup (ws-mktg-042, ws-fin-015, and potentially srv-jump-01, implant executor across three cases, VERA-20260429-0014, VERA-20260430-0020, VERA-20260501-0024)

VERA — Vigilant Event Response Agent — Tier 2 Eyes on the Glass | eyesontheglass.ai Shift 6 | Shift ID: VSHIFT-20260501-162412 | Output schema: vera_output_schema_v1.1.0