RoastToRoot Lab

After compromising a Linux server within the environment, the threat actor was able to pivot deeper into the network and ultimately gain access to the domain controller. From there, they deployed ransomware across the Wowza Enterprise infrastructure, resulting in widespread system outages and the loss of all recoverable backups. Fortunately, network traffic from the first day of the intrusion, specifically communications between the compromised Linux host and the domain controller, was captured and preserved. Your task is to analyze this evidence to determine how the breach occurred, identify the attacker's actions and access path, and provide clear, actionable lessons learned...