Unit 8: Scans, beacons and leaks · Lesson 6 of 6 · 24 min
Case file: the warning two days early
Follow a remote access server from an unprotected login to an internal sweep to a 6 GB upload, and find the alert that was closed unread.
case file
British Library Ransomware Attack
British Library · 2023
On October 28, 2023, the Rhysida ransomware group attacked the British Library, copying about 600GB of data (later leaked when the Library refused to pay) and encrypting or destroying servers. The first detected unauthorized access was on a Terminal Services server used by third parties and IT staff that lacked MFA. Although backups existed, legacy systems could not be restored, forcing a lengthy 'Rebuild & Renew' programme.
What went wrong
A remote access server excluded from the MFA rollout, a flat legacy network that prevented segmentation, and legacy applications that could not be restored from backup onto new infrastructure.
What would have stopped it
- Enforce MFA on every remote access path, including third-party and administrator terminal servers.
- Segment networks so remote access hosts cannot reach the whole estate.
- Retire or plan migration for legacy systems, and test full restores onto new infrastructure, not just backup completion.
- Investigate early warning alerts fully rather than relying on an automated block.
What defenders could have seen
- Suspicious reconnaissance activity days before the attack (seen 25-26 October but not fully investigated).
- Unusual logins on the third-party terminal server outside normal hours.
- Large outbound data transfers from internal file servers.
sourcesbl.uksecurityweek.com
mission
- You are
- The analyst writing the post-incident review.
- Situation
- rds01 is a terminal server used by IT and an outside vendor. Its logins are in
~/logs/rds01-logins.logand its flows in~/flows/rds01-flows.csv. This lab is modelled on the British Library attack. - Goal
- Rebuild the sequence: entry, reconnaissance, missed warning, theft.
- Hand in
- A four-line timeline with times, and the two controls that would have stopped it.
Four days on one server
- 10 Oct 01:52vendor-support logs in, no MFA required
- 10 Oct 02:05128 connections to 64 hosts on 445 and 3389
- 10 Oct 07:15alert auto-blocked and closed, no review
- 12 Oct 01:146.1 GB leaves file01
Read the logins
Look at who logged in, from where, and with what second factor.
cat rds01-logins.log
2026-10-08T09:02:11Z rds01 login user=itops-mlee src=10.10.0.31 mfa=push result=success
2026-10-09T08:47:30Z rds01 login user=itops-mlee src=10.10.0.31 mfa=push result=success
2026-10-10T01:52:06Z rds01 login user=vendor-support src=203.0.113.17 mfa=not_required result=success
2026-10-10T03:31:40Z rds01 logout user=vendor-support
2026-10-10T07:15:02Z soc alert rule=internal-port-sweep host=rds01 action=auto-blocked status=closed-no-review
2026-10-11T10:04:19Z rds01 login user=itops-mlee src=10.10.0.31 mfa=push result=success
2026-10-12T00:58:51Z rds01 login user=vendor-support src=203.0.113.17 mfa=not_required result=success
you should see The vendor account logs in from the internet at night with MFA not required. An alert at 07:15 was closed without review.
Count flows by day
A sudden jump in a server's connection count is reconnaissance more often than not.
cut -d, -f1 rds01-flows.csv | sort | uniq -c
9 2026-10-08
11 2026-10-09
128 2026-10-10
8 2026-10-11
2 2026-10-12
1 date
you should see 128 flows on 10 October against about 10 on normal days.
Size the sweep
Count distinct targets and the ports used.
awk -F, '$1=="2026-10-10" {print $4}' rds01-flows.csv | sort -u | wc -l 64 awk -F, '$1=="2026-10-10" {print $5}' rds01-flows.csv | sort | uniq -c 64 3389 64 445
you should see 64 internal hosts probed on SMB and remote desktop.
Find the theft
Look for any flow over a gigabyte.
awk -F, '$7 > 1000000000' rds01-flows.csv date,time,src,dst,dport,proto,bytes_out,bytes_in 2026-10-12,01:14:09,10.20.0.90,198.51.100.230,443,tcp,4215884102,88210 2026-10-12,01:52:44,10.20.0.90,198.51.100.230,443,tcp,1904337560,41002 awk -F, '$7 > 1000000000 {s+=$7} END {printf "%.1f GB\n", s/1e9}' rds01-flows.csv 6.1 GB
you should see Two uploads from file01 to the same external address, 6.1 GB in total, two days after the sweep.
defender tip An automatic block is not an investigation. Every alert on a remote access host needs a human answer: who, from where, and what next.
What a defender takes away
- 1Every remote access path needs MFA, including vendor and admin servers.
- 2A remote access host should not be able to reach the whole network.
- 3Investigate early warnings fully; attackers often wait days between steps.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.