Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware – The DFIR Report

A threat actor leveraged a fake Windows utility to deploy Cobalt Strike, established persistent backdoors with SystemBC and GhostSOCKS, exfiltrated data via Rclone, and ultimately unleashed LockBit ransomware across the victim’s environment in a coordinated, multi-stage attack.