A cyberattack on the US Department of Defense involved a threat actor using a server and a company's network to scan the department's servers for open file sharing connections, followed by a new malware and tools installation that linked to a different command and control server.
The process of investigating an infected computer after an attack is akin to the scene from Mr. Robot, where Elliot looks into a server directory containing malware files. It is necessary to be sure whether to remove the malware or leave it untouched.
A NetBIOS scanner was used to scan a network and find servers with shared network drives, which could be accessed to view files. The scanner was used to target the US Department of Defense, with 19 of the public IP ranges belonging to the department being scanned.
After an initial infection, a threat actor gained access to a company's domain controller, giving them full admin access over the network and leaving the business at their mercy.