An AiTM phishing email targets marcus.chen (Finance Sr. Manager) via the typosquat domain invoices-ficsit.io. A macro-enabled attachment drops svc32.exe, establishing a C2 beacon to 185.220.101.47. The attacker dumps credentials via LSASS, moves laterally via SMB to RESEARCH-STATION-01, exfiltrates 547 MB over C2 and an additional 14.7 GB via Dropbox through m.blake, then deploys ransomware renaming 847 files with the .IRONLOCK extension. Threat actor TA-001 IRON CHIMNEY (Eastern Europe, RaaS). This is the primary scenario — it surfaces in all ten tools and four labs.
m.blake (Michael Blake, Director of Research) is targeted with a credential phishing email (microsoft-secure-signin.com), followed by MFA push bombing from 203.0.113.88 (Taipei, Taiwan). Three pushes are denied; a fourth is approved under fatigue. The attacker gains admin portal access and attempts to disable MFA for the pioneer account — a parallel attack suggesting coordination with IRON CHIMNEY (same threat actor TA-001). SOAR playbook PB-002 triggers automatic lockdown.
A threat actor impersonates CEO M. Reynolds via m-reynolds-ceo@gmail.com and requests a $47,500 wire transfer to Trident Capital Partners LLC from j.whitfield. Foyl MailGuard intercepts THREAT-002. SOAR playbook PB-008 (BEC Wire Fraud Prevention) is triggered — though currently in draft. Identity detects correlated inbox manipulation rules forwarding finance keywords to an external address.
Threat actor TA-002 COBALT MANTIS registers acme-industr1al.com (homoglyph of the real acme-industrial.com) and sends l.park a billing substitution email requesting a bank account change for a $23,847 wire. MailGuard quarantines THREAT-003. Two hours after l.park responds, CASB detects her uploading vendor contracts (acme_nda_2024.pdf, vendor_pricing_q4.xlsx) to personal Google Drive.