Operation_Split_Horizon

CategoryReverse Engineering

operation-split-horizon.md From: soc-lead@corptech.local To: ir-team@corptech.local Subject: URGENT: IT does not distribute Shawarma via email Bad news: The promised "Free Double Meat Shawarma" was a lie. Worse news: Braa clicked it anyway.

Instead of extra garlic sauce, his workstation received a payload. The attacker rooted around, found something shiny, and exfiltrated it. Attached is the network capture of Braa's poor life choices and the lure page itself.

Please figure out what the attacker took so I know whether to fix it or just update my resume.

@Nyx