ER Tech Pros Detected and Shut Down a Live Server Breach In Real Time

Most security breaches are discovered after the fact. Sometimes days. By then, the data is gone, and the organization is left managing consequences.

This incident was different.

On 15 January 2026, a threat actor used stolen credentials to gain unauthorized access to a client server via Remote Desktop Protocol. Operating outside of business hours, the attacker executed a structured, multi-stage data exfiltration attempt targeting the full contents of the server's data drive.

The client was under active 24/7 protection from ER Tech Pros. The intrusion was identified in real time while exfiltration was still in progress. The incident response team immediately isolated the affected server, recovered the exfiltrated data, and restored operations before the stolen information could be accessed or misused.

This case study details the attack timeline, the detection and response sequence, and the recommendations implemented following the incident.

A Few Terms Worth Knowing

Before we proceed, here are some key terms used in this case study and what they mean:

• Server: A powerful computer that stores a company's files and data. Think of it as the central filing cabinet.
• Credentials: A username and password. The digital keys used to log into a system.
• Data Exfiltration: Secretly copying and sending company data to an outside location. Essentially, it means stealing files.
• S3 Bucket: An online storage container hosted on Amazon's cloud. The attacker used one to receive the stolen files.
• MFA (Multi-Factor Authentication): A second step at login, like a code sent to your phone. It was missing here. That security gap changed everything.
• RClone: A legitimate file-transfer tool that the attacker abused to move company data to their own cloud storage.

Incident Background

The Client Environment

• The client operated on a Windows server environment used to store and manage critical business data
• The affected entity is referenced throughout this case study as the server to protect client confidentiality. It served as the primary data repository for the organization and was accessible remotely via Remote Desktop Protocol
• The D: drive on the server housed the organization's confidential business documents, client records, and operational data, representing the full breadth of sensitive information the business held
• At the time of the incident, no Multi-Factor Authentication was enabled on any remote access point into the server
• Credential-based login was the sole barrier to entry, a single layer of protection on a system that warranted significantly more

The Incident

How the Attacker Got In

On 15 January 2026, a threat actor obtained valid login credentials for the user and authenticated into the server via Remote Desktop Protocol. With no MFA in place, the stolen credentials alone were sufficient to gain full interactive access to the environment. No forced entry. No broken windows. They had a key, and the door opened.

Minute-by-Minute Attack Sequence Timeline

• Once inside the server, the attacker executed a deliberate, well-planned sequence of actions to stage and execute data exfiltration without detection. The entire chain from first action to active exfiltration spanned just 20 minutes. Twenty minutes to plan, prepare, and attempt to walk away with an entire company's data.

01:24 AM UTC — Staging directory created

• The attacker created a hidden directory on the server to store tools away from standard system visibility. This was not opportunistic. It was the first step of a pre-planned operational structure, designed to keep malicious activity off the radar of any surface-level monitoring.

01:26 AM UTC — Exfiltration tool downloaded

• RClone, a legitimate file-transfer utility, was downloaded onto the server from an external domain via an insecure curl command. Repurposing trusted tools is a deliberate tactic; it reduces the likelihood of triggering signature-based detection that would flag overtly malicious software.

01:41 AM UTC — Second directory created and S3 bucket deployed

• Additional staging directories were created on the server. The attacker had pre-created a dedicated Amazon S3 bucket called s3:hazen, specifically to receive the stolen data. At this stage, the entire exfiltration infrastructure was in place. The tool was ready, the destination existed, and the only remaining action was to initiate the transfer.

01:44 AM UTC — Silent exfiltration launched

• A PowerShell command was executed on the server using a hidden window flag, a technique that suppresses any visible process window, allowing RClone to run entirely in the background without appearing on screen. The full contents of the D: drive were initiated for transfer to s3:hazen/IMS.

The operation was designed to be invisible. At the precise moment the attacker initiated the transfer, ER Tech Pros had already identified the intrusion, and the incident response team was in motion.

Detection

The ER Tech Pros 24/7 SOC team raised a HIGH severity alert upon identifying two concurrent suspicious techniques active on the server simultaneously:

• Command and Scripting Interpreter: Unusual script execution detected on the server, indicating a process running entirely outside of normal business activity
• Remote Desktop Protocol: An active RDP session on the server with no legitimate business context, indicating an unrecognized user in control of the server at 1:44 AM

The moment the alert was triggered, the SOC team began reviewing the activity in parallel. Both techniques were corroborating the same threat on the same host at the same time. The alert was validated as a true positive, and the incident response team was engaged immediately, with no escalation delay between detection and action.

The alert was raised while exfiltration was still actively in progress on the server.

Response and Containment

Immediate Actions

Upon receiving the alert, the ER Tech Pros incident response team activated its established response playbook. Like that firefighter crew, no one asked what to do next. Everyone already knew.

1. Alert received: High-severity Falcon OverWatch alert escalated to the team in real time
2. Client notified: Notification email sent immediately, and a phone call was attempted to verify whether the activity was authorized. But the client was unreachable by phone
3. Server network-contained: Given the severity and active nature of the exfiltration, the server was isolated from all external and internal network connectivity before client confirmation, stopping the data transfer in its tracks.
4. Client confirms breach: Client confirmed the activity was not authorized, validating the incident as a genuine breach
5. Attacker's S3 bucket accessed and wiped: The attacker made a critical error. Their RClone configuration file, left on the compromised server, contained their own S3 credentials. The team used those credentials to walk into the attacker's storage, retrieve everything that had been stolen, and delete it permanently.
6. Full malware scan conducted: Server placed under on-demand scanning. Scan returned no malicious software, backdoors, or persistence mechanisms. Absolutely clean.
7. Server restored: Network containment lifted and server returned to full operation.
8. All credentials reset: Every user account on the server had its password changed. Every door. Every lock. Changed.

Root Cause Analysis

Two factors enabled this incident. Remove either one, and this attack does not happen.

Primary Cause: Credential Compromise

• Valid credentials for the user were in the possession of the threat actor before the attack
• Exact acquisition method unconfirmed, but consistent with phishing, credential stuffing, or exposure through a third-party data breach
• A stolen key is dangerous. A stolen key with no backup lock on the door is a disaster waiting to happen.

Secondary Cause: Absence of MFA on Remote Desktop Access

• No Multi-Factor Authentication was configured on RDP access to the server
• Stolen credentials alone were sufficient to authenticate and gain full control of the environment
• With MFA in place, this attack stops at the login screen.

Incident Resolution Summary

What Went Wrong

• Unapproved software could be freely downloaded and executed on the server
• Full contents of the D: drive were temporarily exfiltrated to an attacker-controlled S3 bucket

What Went Right

• Active exfiltration detected in real time while still in progress
• Server isolated immediately, stopping the data transfer before it could complete
• All exfiltrated data was recovered and permanently deleted from the attacker's S3 bucket before it could be accessed, sold, or misused
• Server scanned and confirmed clean with no malware or persistence mechanisms found
• All user credentials reset, and attacker access fully and permanently revoked

Recommendations

Priority 1: Implement MFA on All Remote Access Points Immediately

MFA on Remote Desktop Protocol and all externally accessible systems would have prevented this attack entirely at the authentication stage. No debate, no complexity, no delay. This is the single highest-impact change the client can make today.

Priority 2: Restrict Software Execution to Approved Applications Only

Configure the server environment to block unapproved software installation and execution using solutions such as AppLocker or Windows Defender Application Control. An attacker who cannot run their own tools is an attacker who cannot complete their mission.

Priority 3: Enforce Strong Password and Credential Hygiene Policy

• All accounts should use long, unique passwords
• Conduct regular credential audits across all accounts
• Deploy a password manager to help staff maintain secure credentials without friction
• A weak password is an open invitation. Make sure none exist.

Priority 4: Conduct Regular Phishing Awareness Training

• Credential theft most commonly originates from phishing
• Periodic simulated phishing campaigns and staff education programs reduce the likelihood of initial credential compromise
• The best firewall in the world cannot stop an employee who clicks the wrong link. Training is a frontline defense.

Priority 5: Maintain and Expand 24/7 Managed Detection and Response Coverage

Falcon OverWatch detection was the direct reason this breach was identified and contained before causing lasting damage. In this incident, minutes mattered. Continuing and expanding this coverage is not optional. It is essential.

About ER Tech Pros

ER Tech Pros is a managed security services provider delivering 24/7 threat detection, incident response, and endpoint protection to businesses across industries. The ER Tech Pros security operations center continuously monitors client environments, identifies threats in real time, and responds with a tested incident response playbook so that your business stays protected 365 days of the year.

When attackers come for your data, the question is not whether you will be targeted. The question is, who is standing between them and everything you have built?

Make sure it is ER Tech Pros!

Incident date: 15 January 2026 | Classification: Internal / Client Confidential

Prepared by: ER Tech Pros Cybersecurity Team