The Shadows of Ghosts: Inside the Response of a... | RSA Link

RSA Incident Response details a unique CARBANAK/FIN7 intrusion (mid‑2017) that leveraged the Apache Struts CVE‑2017‑5638 exploit to obtain administrative access, deploy a cross‑platform mix of custom and legitimate admin tools with low AV detection, traverse roughly 150 systems over a 35‑day dwell period, and execute lateral movement, credential harvesting, tunneling, and cleanup; the paper includes toolset analysis, sample hashes and detection ratios, described TTPs, and the IR methodology that enabled containment and remediation within nine days.