Cyberattack on a retail company: lessons learned (RETEX)
Cyberattack on a retail company: lessons learned (RETEX). The attack unfolded in 4 main stages, from a compromised account to Lockbit, which we detail below.
What actions did the attacker take during this attack?
The attack unfolded in 4 main stages, which we walk you through below.
1. Initial access via a compromised account
The attacker managed to break into the information system by exploiting a compromised initial access account.
2. Internal reconnaissance and lateral movement
Once inside, the attacker ran an internal scan of the infrastructure, then moved laterally across the IS to explore and identify potential access points.
3. Internal analysis and propagation
Through repeated internal analysis and lateral movement, the attacker consolidated their position in the information system, setting the stage for the next phase of the attack.
4. Lockbit propagation across the network
The attack reached a critical level when the Lockbit malware was propagated across the network, threatening to paralyse all of the company’s operations.
How many days did the attack last?
These actions took place over a period of five days, highlighting the complex challenges companies face when dealing with cyberattacks.
Performance indicators and detection
Despite the sophistication of the attack, the Cyna SOC teams deployed effective measures to contain and counter the attack**.**
Here are some highlights of their work:
- Scope of the monitored infrastructure: 950 assets under management, with one data centre under monitoring.
- Vulnerabilities identified: 46 end-of-life (EOL) assets, 564 critical vulnerabilities.
- Activity detectors: identification of 5 different remote access tools and 156 types of mass storage in use.
- Management of obsolete versions: 9 assets running outdated versions of Adobe Flash Player for 4 years.
The SOC team’s rapid and effective intervention stopped the attacker’s progress, avoiding even more serious damage to the company.
Key takeaways
In conclusion, this incident underlines the importance of robust cybersecurity to protect companies against cyber threats.
The company is committed to strengthening its security posture and to working closely with its teams to prevent future attacks.
We will continue to support their efforts to protect and secure their information system, in order to guarantee safe and reliable operation of their business.
Stay tuned for more updates on our security initiatives and our measures to protect against cyber threats.
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.