MALWARE ON THE MENU:HOW A SIMPLE FOOD ORDER NEARLY POISONED A COMPANY’S SYSTEMS

Executive Summary

A recent cybersecurity incident involving a NetCyberOps client shows just how easily everyday online activity - like employees ordering lunch on their company device - can lead to serious security risks.

In this case, a user unknowingly visited a hacked local restaurant website that secretly delivered a harmful program to their computer. This program, part of a malware family known as SocGholish, is designed to open the door for more dangerous attacks. If it hadn't been caught immediately, the attackers could have gained access to sensitive company data, moved through internal systems, and potentially deployed ransomware that could lock the business out of critical operations.

Fortunately, NetCyberOps detected the threat right away. Our systems identified the malware before it could do any damage, and we quickly isolated the infected computer from the network. Thanks to this fast response, the attackers were blocked from moving deeper into the system or launching further attacks.

We advised the client to safely wipe and reset the affected device, and to change any passwords used on it. In addition, we created a custom threat detection plan based on the details of this attack. This plan not only strengthens the client's defenses going forward, but also improves protection for all NetCyberOps customers.

Incident Timeline

10:05am

NCO’s security analysts received an alert through our dashboard and immediately initiated an investigation.

NCO security dashboard showing initial SocGholish malware alert at 10:05am
10:05-10:14am

Using SentinelOne, analysts identified outbound POST requests to a malicious domain, which was subsequently confirmed by the VirusTotal community as part of known SocGholish infrastructure. The team immediately contacted the customer’s designated emergency point of contact and placed the affected device into network quarantine in less than 10 minutes.

SentinelOne alert identifying outbound POST requests to a confirmed SocGholish malicious domain
10:14-10:50am

Further analysis within SentinelOne revealed malicious DNS requests from the affected device to a Command and Control (C2) server. This activity provided an additional Indicator of Compromise, which was also linked to SocGholish by the VirusTotal community.

At this point, NetCyberOps had successfully contained the threat, but the exact method of initial infection remained unknown. To identify the source, the team began reviewing SentinelOne Deep Visibility logs for further insight.

Using the SentinelOne Storyline report, the team observed Chrome launching wscript.exe, followed by a series of malicious child cmd.exe processes. These processes were responsible for actions related to persistence and system reconnaissance.

SentinelOne Storyline report showing Chrome launching wscript.exe and malicious cmd.exe child processes

Through timeline analysis and correlation with the execution of chrome.js, NetCyberOps identified the likely source of the watering hole attack. A menu website for a local restaurant had been accessed just seconds before the malicious activity began. Further investigation revealed that the site had been flagged as a security risk and categorized as a compromised domain.

Within an hour of the first alert, the NCO team had identified the source of the attack and successfully prevented any further compromise.

Restaurant menu website flagged as a compromised domain and security risk

Follow Up

NCO collected evidence to support the creation of a tailored threat hunting profile for SocGholish. Rapid7’s Script Redirection Detection rules significantly streamlined this process.

The command in the screenshot shows the attacker executing cmdkey /list using basic evasion techniques and redirecting the output to a .tmp file. This command is commonly used by threat actors to enumerate stored credentials, which can later be leveraged for lateral movement or privilege escalation.

These captured reconnaissance commands not only revealed what information had already been gathered from the customer’s network, but also provided NetCyberOps with valuable input for developing threat detection rules to support future threat hunting efforts.

NCO even contacted the restaurant to offer assistance and share details of the investigation regarding the website compromise to help prevent further incidents.

Attacker executing cmdkey /list command with output redirected to a .tmp file for credential enumeration

Action Items

As this case study makes clear, even something as mundane as ordering pizza for a company meeting can create cybersecurity risks. Without proactively deploying the right monitoring tools and having expert analysts constantly ready to take action on alerts, a small incident could balloon into disrupting a company’s entire operations. This incident highlights why even smaller companies - who don’t think they can be a target of threat actors - can help ensure business continuity by employing fully managed cybersecurity services.

CURIOUS WHAT IT TAKES TO GET SECURE?

Schedule DemoLearn About Our Onboarding Process