On January 15, 2026, Ashford Sterling Recruitment suffered a sophisticated full-chain intrusion consistent with Initial Access Broker (IAB) tradecraft. The compromise began when a user on AS-PC1 (Sophie.Turner) executed a malicious file masquerading as a recruitment CV — Daniel_Richardson_CV.pdf.exe — downloaded from the company network. The file used the double-extension technique (T1036.007) to deceive the user into believing it was a PDF document.

Once executed, the malware established Command & Control communications to cdn.cloud-endpoint.net and began systematic enumeration of the environment. The threat actor proceeded through credential access (registry hive dumping of SAM and SYSTEM), network discovery, and lateral movement across all three company devices — pivoting from AS-PC1 to AS-PC2 then to AS-SRV. The attacker deployed AnyDesk remote access tool on all three machines using certutil as a download proxy, configured an unattended-access password, and established scheduled task persistence on both AS-PC2 and AS-SRV under the masqueraded binary RuntimeBroker.exe.

On AS-SRV, the actor accessed the C:\Shares\Payroll\ directory, opened BACS_Payments_Dec2025.ods (a BACS payment file containing banking details), and created an archive Shares.7z packaging the share contents for exfiltration. In-memory credential theft was conducted via SharpChrome reflectively loaded into notepad.exe, targeting saved browser passwords from both Microsoft Edge and Google Chrome via DPAPI decryption. Event logs were cleared on completion to degrade forensic visibility. All evidence was reconstructed from Microsoft Defender for Endpoint telemetry in Microsoft Sentinel.

• Initial Access: User Sophie.Turner executed Daniel_Richardson_CV.pdf.exe after double-clicking it from the Downloads folder — masqueraded as a recruitment CV using double-extension technique (T1036.007). Parent process: explorer.exe.
• C2 Establishment: Malware immediately established outbound HTTPS communications to cdn.cloud-endpoint.net for command & control beaconing.
• Discovery: Malware executed whoami.exe, ipconfig.exe, and net.exe view to enumerate the victim identity, network configuration, and visible network shares. net localgroup Administrators was also queried.
• Credential Access: reg.exe was used to dump HKLM\SAM and HKLM\SYSTEM registry hives to C:\Users\Public\ as sam.hiv and system.hiv — enabling offline NTLM hash extraction.
• Remote Tool Deployment: AnyDesk was downloaded via certutil.exe -urlcache -split -f from download.anydesk.com to C:\Users\Public\AnyDesk.exe on all three hosts. Unattended password set to intrud3r!.
• Backdoor Account Creation: net.exe user svc_backup [password] /add followed by net.exe localgroup Administrators svc_backup /add — creating a persistent local admin account on AS-PC1.
• Lateral Movement: From AS-PC1, attacker attempted WMIC (×4) and PsExec (×2) against AS-PC2 — all failed. Succeeded via mstsc.exe /v:10.1.0.183 (RDP). From AS-PC2, WMIC (×2) against AS-SRV failed; succeeded via mstsc.exe /v:10.1.0.203.
• Scheduled Task Persistence: On AS-PC2 and AS-SRV, Daniel_Richardson_CV.pdf.exe was downloaded via certutil and saved as C:\Users\Public\RuntimeBroker.exe (masquerading as a Windows system binary). A scheduled task named MicrosoftEdgeUpdateCheck was created to execute it daily at 03:00 with highest privileges.
• Data Access: On AS-SRV, the attacker accessed C:\Shares\Payroll\BACS_Payments_Dec2025.ods (BACS banking payment file) — confirmed editing via LibreOffice lock file artifact. Contents of all shares were archived into Shares.7z.
• In-Memory Credential Theft: SharpChrome was reflectively loaded (T1620) into notepad.exe — a legitimate Windows process — to steal saved passwords from Chrome and Edge via DPAPI decryption. No SharpChrome file ever appeared on disk.
• Anti-Forensics: Four Windows event logs cleared using wevtutil.exe cl: Security, System, Application, Windows PowerShell. Memory region protection was also modified in notepad.exe address space.

The intrusion followed a systematic, multi-stage methodology consistent with a professional IAB operator. The attacker leveraged social engineering for initial access, a custom malware dropper for C2 and execution, legitimate Windows binaries (certutil, reg, net, schtasks, mstsc) for all subsequent actions — a LOLBIN (Living Off the Land Binaries) strategy that minimizes new file writes and evades AV detection. The full methodology is detailed in sections S1–S9 below.

Initial access was achieved via user execution of a masqueraded executable. The file Daniel_Richardson_CV.pdf.exe was delivered to Sophie.Turner's Downloads folder, disguised as a recruitment CV using the double-extension technique — the .pdf prefix was designed to make the file appear as a PDF document to an untrained user. Windows hides known file extensions by default, making this deception highly effective.

When Sophie.Turner double-clicked the file, Windows Explorer (explorer.exe) spawned it as the parent process — confirming direct user interaction. The malware ran with High integrity level and Default token elevation, meaning it ran with Sophie.Turner's full privileges. Almost immediately it spawned notepad.exe "" as a child process — an unusual invocation (empty argument string) that serves as a host process for code injection.

DeviceProcessEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName == "as-pc1"
| where FileName =~ "Daniel_Richardson_CV.pdf.exe"
| project Timestamp, FileName, SHA256, FolderPath,
          InitiatingProcessFileName, ProcessCommandLine

Once executed, the malware established outbound communications over HTTPS (port 443) to cdn.cloud-endpoint.net — the C2 server. Using HTTPS over port 443 is deliberate: this traffic is encrypted and blends into normal web browsing, making it difficult to distinguish from legitimate CDN traffic at the network layer without TLS inspection. The domain name itself (cdn.cloud-endpoint.net) is designed to appear as a legitimate cloud CDN service.

A separate domain — sync.cloud-endpoint.net — served as the payload staging server. This separation of C2 and staging infrastructure is a tradecraft indicator: if the staging domain is burned (blocked), the C2 channel remains intact, and vice versa. All certutil-based payload downloads (RuntimeBroker.exe on PC2 and SRV) originated from the staging domain.

DeviceNetworkEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName == "as-pc1"
| where InitiatingProcessFileName =~ "Daniel_Richardson_CV.pdf.exe"
| project Timestamp, RemoteUrl, RemoteIP, RemotePort,
          InitiatingProcessFileName
| order by Timestamp asc

The attacker used reg.exe — a built-in Windows utility — to dump two critical registry hives from HKLM (HKEY_LOCAL_MACHINE) to disk. These two hives together are sufficient to extract all local account NTLM password hashes offline using tools like Impacket secretsdump or samdump2.

HKLM\SAM (Security Account Manager) stores all local user account password hashes. However, the hashes inside SAM are encrypted using the system boot key. HKLM\SYSTEM contains that boot key. Without SYSTEM, SAM is useless. Together, they allow full offline NTLM hash extraction — which can then be cracked offline or used directly in Pass-the-Hash attacks without ever knowing the plaintext password. Both files were staged to C:\Users\Public\ — a world-readable directory ideal for attacker staging due to no permission restrictions.

DeviceProcessEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName == "as-pc1"
| where FileName =~ "reg.exe"
| project Timestamp, AccountName, FileName, ProcessCommandLine
| order by Timestamp asc

Immediately after execution, the malware launched a systematic environment discovery phase using native Windows utilities. This is consistent with automated post-exploitation reconnaissance scripts embedded in the malware — the commands ran within seconds of initial execution in rapid succession.

DeviceProcessEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName == "as-pc1"
| where FileName in~ ("whoami.exe","net.exe","ipconfig.exe","hostname.exe")
| project Timestamp, AccountName, FileName, ProcessCommandLine
| order by Timestamp asc

AnyDesk is a legitimate remote desktop application widely used in enterprise environments. The attacker leveraged it as a persistent, covert remote access channel — separate from the C2 malware — meaning even if the malware is detected and removed, the attacker retains GUI-level access to all three compromised hosts through AnyDesk's unattended access feature.

Deployment method: AnyDesk was downloaded using certutil.exe -urlcache -split -f — a classic LOLBIN technique abusing a built-in Windows certificate utility for file download. Certutil is not expected to make external connections in most environments, but it is rarely blocked because it has legitimate uses. The -split flag forces binary file writing, and -urlcache uses IE's URL cache mechanism.

Unattended access password: After deployment, the attacker configured AnyDesk for unattended access using the command echo intrud3r! | AnyDesk.exe --set-password — piping the password directly into stdin to avoid it appearing as a visible argument in process telemetry (the password appears as asterisks in most logging). The config file was then read via cmd.exe /c "type C:\Users\Sophie.Turner\AppData\Roaming\AnyDesk\system.conf" to verify configuration.

DeviceFileEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName has_any ("as-pc1","as-pc2","as-srv")
| where FileName has_any ("AnyDesk.exe","AnyDesk[1].exe")
| project Timestamp, DeviceName, ActionType, FolderPath,
          FileName, SHA256, InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

DeviceFileEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName has_any ("as-pc1","as-pc2","as-srv")
| where InitiatingProcessFileName =~ "AnyDesk.exe"
| project Timestamp, DeviceName, ActionType, FolderPath,
          FileName, InitiatingProcessAccountName
| order by Timestamp asc

DeviceProcessEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName has_any ("as-pc1","as-pc2","as-srv")
| where ProcessCommandLine has ".conf"
| project Timestamp, DeviceName, AccountName, FileName,
          ProcessCommandLine
| order by Timestamp asc

The attacker systematically attempted lateral movement using multiple remote execution tools before succeeding with RDP. This trial-and-error pattern — exhausting WMIC then PsExec before falling back to mstsc — is characteristic of a human operator adapting in real-time to environmental restrictions (firewall rules, disabled services, credential issues).

DeviceProcessEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName has_any ("as-pc1","as-pc2","as-srv")
| where FileName in~ ("psexec.exe","wmic.exe","winrs.exe","mstsc.exe",
                      "schtasks.exe","sc.exe","at.exe","net.exe")
| where ProcessCommandLine has_any ("\\\\","/node:","-s ","/s ",
                                    "/v:","computername","/r:")
| project Timestamp, DeviceName, AccountName, FileName,
          ProcessCommandLine
| order by Timestamp asc

On both AS-PC2 and AS-SRV, the attacker established scheduled task persistence using the same malware binary (Daniel_Richardson_CV.pdf.exe) renamed to RuntimeBroker.exe. RuntimeBroker.exe is a legitimate Windows system process (responsible for managing permissions for apps from the Microsoft Store), making this an effective masquerade — defenders are less likely to question a process with a known-legitimate name.

The scheduled task was named MicrosoftEdgeUpdateCheck — again chosen to blend in with legitimate Microsoft Edge update tasks that exist in enterprise environments. It was configured to run daily at 03:00 (3 AM) with highest privilege, providing the attacker with a persistent daily callback window even if the active session is terminated or the machine is rebooted.

The SHA256 of RuntimeBroker.exe matches the original malware exactly — confirming it is the same payload, just renamed. Additionally, the backdoor account svc_backup was created on AS-PC1 and added to the Administrators group — providing a second persistent access path via local credentials, independent of AnyDesk or scheduled tasks.

DeviceProcessEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName has_any ("as-pc1","as-pc2","as-srv")
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has "/create"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp asc

DeviceProcessEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName has_any ("as-pc1","as-pc2","as-srv")
| where FileName in~ ("net.exe","net1.exe")
| where ProcessCommandLine has " user "
| where ProcessCommandLine has "/add"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp asc

On AS-SRV, the attacker navigated to C:\Shares\Payroll\ and opened BACS_Payments_Dec2025.ods — a LibreOffice spreadsheet containing BACS (Bankers' Automated Clearing Services) payment records. BACS files typically contain employee or supplier bank account numbers, sort codes, and payment amounts. This is highly sensitive financial data with direct fraud potential.

Proof of editing (not just viewing): When LibreOffice opens a document for editing, it immediately creates a lock file in the same directory with the naming pattern .~lock.<filename>#. This lock file exists ONLY while the document is actively open. A simple copy or view would never create this file. The presence of .~lock.BACS_Payments_Dec2025.ods# is therefore forensic proof that the document was opened and edited — not merely copied.

Following data access, the attacker used Windows Explorer (explorer.exe via a Guacamole RDP session as AS.SRV.Administrator) to create Shares.7z — packaging the entire contents of the C:\Shares directory for exfiltration. The archive was staged within the shares directory itself before exfiltration.

DeviceFileEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName =~ "as-srv"
| where FolderPath has @"C:\Shares"
| project Timestamp, ActionType, FolderPath, FileName, SHA256,
          InitiatingProcessFileName, InitiatingProcessAccountName,
          InitiatingProcessRemoteSessionDeviceName
| order by Timestamp asc

The attacker conducted two distinct anti-forensic operations: log clearing to degrade visibility into their actions, and reflective code loading to execute credential theft tooling without touching disk — making traditional file-based detection impossible.

DeviceProcessEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName has_any ("as-pc1","as-pc2","as-srv")
| where FileName =~ "wevtutil.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp asc

DeviceEvents
| where Timestamp between (datetime(2026-01-15) .. datetime(2026-01-16))
| where DeviceName == "as-pc1"
| where InitiatingProcessFileName =~ "notepad.exe"
| project Timestamp, ActionType, InitiatingProcessFileName,
          AdditionalFields
| order by Timestamp asc