At a glance
- Client
- An investment and trading firmName withheld for confidentiality
- Industry
- Banking
- Service
- Cybersecurity
- Scope
- Threat hunting, incident response and security hardening
The challenge
The firm held valuable trading strategies and client data, making it a target for well-resourced attackers who avoid triggering standard alerts. Its security tools produced plenty of alerts but little insight.
Unusual activity on a few servers raised concern, but nobody could say whether it was an attack or noise.
Our approach
Assume compromise
We hunted proactively across endpoints, network traffic and identity logs instead of waiting for alerts.
Follow the trail
Analysts reconstructed the attacker's movements, tools and persistence mechanisms.
Contain without tipping them off
Containment was planned so the attacker lost access everywhere at once.
Close the gaps
We hardened identity, segmentation and monitoring to block the same route in future.
The solution
The intrusion was found and removed before any trading data was taken. The firm now runs a regular threat hunting programme alongside its monitoring, looking for attackers who deliberately stay quiet.
Detection rules built from this incident are now part of everyday monitoring.
Results
- Stealthy intrusion detected through proactive hunting
- Coordinated containment across all affected systems
- Identity and network weaknesses closed
- Ongoing hunting programme and new detection rules
Technology used
- EDR
- SIEM
- Threat intelligence
- MITRE ATT&CK
- Network forensics
Facing a similar challenge?
Tell us what you are working on. We will walk you through how we would approach it, with no obligation.