Malware Investigation: NetSupport RAT Pokemon Phishing Campaign
Investigate a sophisticated phishing campaign where threat actors distributed the NetSupport Remote Administration Tool (RAT) by disguising it as a popular Pokemon card game. You will analyze the infection chain from the initial web download through persistence mechanisms and command-and-control configuration using SIEM, XDR, and Firewall logs.
Start this operation
Requires a Pro subscription.
View Pro PlansFree forever — no credit card required
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Identify the Initial Phishing Domain
20Analyze the Dropper Execution
30Investigate Brute Force Origin
35Identify the source IP address used by the attacker to successfully breach the executive workstation via RDP after multiple failed attempts.
Extract C2 Configuration
40Identify Masquerading Binaries
355 tasks · 160 points total
Start investigationTraining Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
This operation requires a Pro subscription.
View Pro PlansFree forever — no credit card required
More Operations
View allClickFix: The Fake CAPTCHA Trap
Investigate a modern 'ClickFix' social engineering attack where a user was tricked into executing a malicious PowerShell command via a fake CAPTCHA interface. You will analyze SIEM and XDR telemetry to trace the infection from the initial web lure to the deployment of an infostealer.
Phishing Investigation: ZipLine Supply Chain Campaign
Investigate a sophisticated social engineering campaign targeting manufacturing supply chains. You will analyze a 'reversed' phishing flow where attackers use 'Contact Us' forms to trick employees into initiating email conversations, leading to the deployment of the custom MixShell in-memory implant via DNS tunneling.
Credential Harvesting: The Lookalike Login
An investigation into a modern phishing campaign targeting critical infrastructure. You will analyze email headers for domain spoofing, identify 'Paste and Run' execution chains, and track the delivery of the LummaC2 information stealer through SIEM logs.