{"id":7860,"date":"2026-02-22T19:39:46","date_gmt":"2026-02-22T17:39:46","guid":{"rendered":"https:\/\/scalemedia.co.za\/cybermedia\/?post_type=docs&p=7860"},"modified":"2026-02-22T19:39:47","modified_gmt":"2026-02-22T17:39:47","password":"","slug":"analysis-of-insight-nexus-breach","status":"publish","type":"docs","link":"https:\/\/scalemedia.co.za\/cybermedia\/docs\/analysis-of-insight-nexus-breach\/","title":{"rendered":"Analysis of Insight Nexus Breach"},"content":{"rendered":"\n

Incident Scenario<\/h2>\n\n\n\n

The victim in this incident is Insight Nexus<\/code>, a mid-sized market research and data analytics firm headquartered in Singapore. They provide competitive intelligence and consumer insights for global clients, including Fortune 500 companies in IT and finance. Their infrastructure includes many applications, servers, and hosts, but we’ll focus on the important ones, such as an internet-facing application stack for clients, a ManageEngine server for IT administration, and a PHP-based customer reporting portal. Because of the nature of their work, they became an attractive target for adversaries interested in client data theft.<\/p>\n\n\n\n

Let’s take a look at the incident to understand some challenges that incident handlers face. This incident shows an example of the patterns repeatedly observed in real-world incidents. The victim in this scenario is Insight Nexus<\/code>, a global market research firm that handles sensitive competitive data for high-profile clients in the IT sector. The firm becomes a target of two distinct threat groups operating simultaneously within its environment. The first threat actor gained entry when system administrators forgot to change the default admin\/admin password on an internet-facing application, i.e., ManageEngine ADManager Plus<\/code>, after a product update. By leveraging this, the attackers logged in successfully, performed reconnaissance, mapped users and machines, and eventually created new privileged Active Directory accounts. Using one of the newly created accounts, the adversaries pivoted further into the environment, identifying an external RDP service exposed by misconfiguration. Exploiting that entry point, they escalated their control and eventually used Group Policy Objects (GPOs) to deploy spyware using an MSI package across multiple endpoints.<\/p>\n\n\n\n

\"Network<\/figure>\n\n\n\n

For days, these activities went unnoticed. The incident was first discovered one day when an analyst from the SOC team investigated an alert on TheHive<\/code> (Security Incident Response Platform) related to the creation of a suspicious file named checkme.txt<\/code> in the root of a web server. Upon investigation, they discovered that it was deliberately placed there as a signature \u2014 “SilentJackal was here”. This unusual artifact triggered a deeper investigation. What made the situation more complex was that the SOC team then realized two different threat actor groups were active in the same environment. While the first group was still exploring and deploying persistence mechanisms, a second actor had already compromised a vulnerable PHP application earlier, exfiltrated sensitive market research data, and significantly reduced their activity after achieving their objective, leaving only occasional connections to an external IP.<\/p>\n\n\n\n

Threat Actors<\/h2>\n\n\n\n