Ref. CF-DBRT-2026-0417 · Rev. 1.0 · Classification: Confidential (example)
Data Breach
Resilience Test
A real attack simulation in a controlled environment, from the perspective of an attacker inside the network. Assessment of the detection and response capability of antivirus, EDR/XDR, MDR and SOC against techniques never seen before.
The defenses did not see the attack.
The attacker saw everything.
Starting from a single workstation with a standard domain user, the Cyberfero team achieved full control of the Active Directory domain in under an hour, exfiltrating data and simulating ransomware encryption. The EDR/XDR solutions and the MDR service did not stop the attack chain; the SOC raised no alert.
Project files, the SAM database, credentials and memory dumps exfiltrated through an undetected channel.
Esecuzione di codice arbitrario con privilegi NT AUTHORITY\SYSTEM e successiva scalata a Domain Admin.
Ransomware simulation successfully executed on an isolated shared folder: full encryption, no blocking.
Note: in the real test the ransomware simulation is run exclusively on a dedicated, agreed test volume, with no impact on the client’s production data.
How the simulation was conducted
The test reproduces the most realistic and most feared scenario: an attacker who is already inside — after a successful phishing, a compromised device or through an insider — starting from an ordinary workstation with an unprivileged domain user. From there we measure how far they can get and, above all, what the defense can see and stop.
- Bypass of endpoint controls (antivirus, EDR/XDR) and the MDR service
- Malware deployment, command-and-control channel, data exfiltration
- Privilege escalation and movement toward the domain
- Assessment of the detection and response capability of MDR and SOC
- Ransomware simulation on a dedicated test volume
- No impact on production data and systems
- Encryption performed only on an isolated, agreed volume
- Activity authorized in writing and limited to the agreed scope
- No service disruption and no exfiltration of real data
- Time window and contacts agreed before start
Severity scale
Results summary
FAIL = the attack succeeded and was not blocked. PASS = the defense detected or prevented the action. Entries marked ★ are the six core tests of the service.
The kill-chain, minute by minute
Example timings, measured from the first command run on the initial workstation to full control of the domain.
Initial access
ATT&CK · TA0001Session on WKS-UFF-14 with the domain user company\m.riva. No administrative privileges, EDR and MDR agent active and up to date.
Antimalware Scan Interface bypass and toolkit execution
ATT&CK · TA0005In-memory disabling of the Antimalware Scan Interface control and execution of the proprietary loader. The EDR raises no detection.
Trojan deployment and C2 channel
ATT&CK · TA0011Stealth connection to the operator’s server. The channel passes network controls and is not flagged by the SOC.
Data exfiltration
ATT&CK · TA0010Extraction of project files, SAM database and memory dumps through the trojan channel.
Privilege escalation
ATT&CK · TA0004Abuse of a vulnerable local service to obtain NT AUTHORITY\SYSTEM on the workstation.
Domain enumeration
ATT&CK · TA0007Mapping of Active Directory and the attack paths toward privileged accounts.
Domain Admin & DC control
ATT&CK · TA0004Extraction of privileged credentials and full access to the Domain Controller and resources.
Ransomware simulation
ATT&CK · TA0040Full encryption of an isolated test share. No blocking, no alert raised throughout the entire chain.
The six core tests
For each core test: description, impact, demonstrative evidence and mitigation. The evidence shown is an illustrative reconstruction with fictitious data.
Data Breach Exfiltration Test
Description
Once the command-and-control channel was established, the team transferred project files, the local SAM database and system artifacts to an external server. The traffic was not recognized as exfiltration by either the network or the MDR.
operator@cf-lab:~/dbrt$ cf-exfil --target WKS-UFF-14 --pull "\Progetti\*.step" [i] C2 channel active · AES-256 encryption · 64 KB chunks [i] collected: 214 files · 1.87 GB ✓ Progetti\Linea-A\stampo_v7.step ✓ Progetti\Contratti\fornitura-2026.pdf ✓ Windows\System32\config\SAM [+] transfer completed in 3m 12s — 0 alerts raised
- Vector
- Canale C2 del trojan
- Data (example)
- CAD projects, contracts, SAM
- Detected by
- No control
- ATT&CK
- T1041 · Exfiltration over C2
- Deploy a DLP solution with inspection of outbound channels
- Segment the network and restrict connections to external hosts
- Enable detection rules on anomalous volumes and destinations
Ransomware Test
Description
A ransomware simulator was run on a dedicated, agreed volume. The process encrypted the entire content without being stopped by EDR/XDR, and without triggering any containment action from the MDR.
operator@cf-lab:~/dbrt$ cf-rw-sim --path Z:\LAB-ISOLATO --ext .company-lock [i] SIMULATION mode · test volume only [i] enumerated 4,812 files · 22.4 GB [!] encrypting... ############################ 100% [!] ransom note written: READ_ME_COMPANY.txt [+] 4,812 files encrypted in 6m 04s — EDR: no action · MDR: no containment
- Target
- Test volume Z:\LAB-ISOLATO
- Files (example)
- 4,812 encrypted
- Detected by
- No control
- ATT&CK
- T1486 · Data Encrypted for Impact
- Adopt an anti-ransomware solution with behavioral detection
- Immutable, tested backups with verified restore
- Blocking rules on mass file encryption
Trojan Test & system takeover
Description
A custom-built script or executable established a stealth connection with the operator, imported additional code and ran arbitrary commands. Combined with the abuse of a vulnerable local service, it enabled execution with maximum privileges.
operator@cf-lab:~/dbrt$ cf-implant --deliver azienda_update.exe --stealth [i] beacon received from WKS-UFF-14 · user: company\m.riva [i] Antimalware Scan Interface: bypassed · AV/EDR: no detection beacon> getsystem # abuse of service "CompanyAgentSvc" [+] elevated to NT AUTHORITY\SYSTEM beacon> whoami nt authority\system
- Payload
- Proprietary trojan (example)
- Privileges
- user → SYSTEM
- Detected by
- No control
- ATT&CK
- T1204 · T1543 · T1068
- Application allow-listing / Zero-Trust approach to execution
- Removal of weak permissions on local services
- EDR hardening and blocking of execution from user paths
MDR Test
Description
Throughout the entire activity — Antimalware Scan Interface bypass, trojan deployment, exfiltration, escalation and ransomware — the MDR service neither isolated the host nor reported the incident. The expected response time (containment within a few minutes) was not met.
event expected actual Antimalware Scan Interface bypass alert <2m none outbound C2 beacon alert <2m none privilege escalation isolation none mass encryption block none [!] host never isolated · incident never opened
- Coverage
- MDR 24/7 (example)
- Hosts isolated
- 0
- Incidents opened
- 0
- Result
- FAIL
- Review playbooks and detection thresholds with the MDR provider
- Define and periodically test isolation SLAs
- Introduce recurring purple team exercises
SOC Test
Description
The relevant events — anomalous logons, service creation, mass LDAP queries, traffic to unknown hosts — did not translate into any correlated alert. The required telemetry was partial or not forwarded to the SIEM.
soc@company:~$ siem-query --window "2026-04-17 09:00→10:00" --sev high [i] sources queried: EDR, DC, firewall, proxy [i] alert severità alta/critica: 0 [i] mass LDAP events uncorrelated: 1 (not alerted) [!] no case created during the attack window
- Critical alerts
- 0
- Cases opened
- 0
- Telemetria
- parziale
- ATT&CK
- Cross-cutting detection gap
- Complete telemetry forwarding (EDR, DC, DNS, proxy) to the SIEM
- Create correlation rules on the observed techniques
- Validate detections with periodic adversarial tests
AV / EDR / XDR Evasion Test
Description
The techniques used — absent from known signatures — bypassed antivirus, EDR and XDR at both the static and behavioral level. The result indicates a configuration that favors compatibility over blocking.
operator@cf-lab:~/dbrt$ cf-evasion --suite full static scan ......... bypass behavioral analysis ... bypass memory scanning ........... bypass execution blocking ......... none [!] 0 detections across 9 techniques executed
- Techniques
- 9 executed
- Detected
- 0
- Piani
- statico + comportamentale
- ATT&CK
- T1562 · T1055 · T1027
- Move the EDR/XDR configuration toward a blocking posture
- Enable memory protection and tamper protection
- Reduce exclusions and validate them periodically
Supporting findings
Additional actions that made the compromise possible or amplified it. Each with a brief impact and mitigation.
The attack chain on the ATT&CK matrix
Ogni tecnica osservata durante la simulazione è collocata sulla tattica corrispondente. Le celle accese sono state executed con successo; clicca una tecnica per il dettaglio, l’evidenza collegata e l’esito.
Select a technique in the matrix to see its description, linked evidence and outcome.
What to do, and in what order
Priorities derived from impact and ease of action. Not a wish list, but actions in order.
- Reconfigure EDR/XDR into blocking mode and reduce exclusions
- Enable tamper and memory protection
- Review isolation SLAs with the MDR provider
- Remove local credentials used for authentication
- Introduce application allow-listing / Zero-Trust
- Implement DLP and network segmentation
- Adopt behavioral anti-ransomware and immutable backups
- Complete telemetry forwarding to the SIEM
- Active Directory hardening and tiering of privileged accounts
- Migration to Wi-Fi WPA2/3 Enterprise
- Recurring purple team exercises
- Repeat the Data Breach Resilience Test after remediation
Your report would be on your real network.
The Data Breach Resilience Test verifies in the field whether your defenses withstand a real attack, in a controlled environment and with no risk to operations. At the end you receive a report like this one, on your own systems.
Example document. This report is a demonstrative facsimile of the deliverable of Cyberfero’s Data Breach Resilience Test service. The client company, hosts, addresses, users, credentials, timings and results shown are entirely fictitious and do not refer to any real organization. The technical evidence (terminals, output, tables) is an illustrative reconstruction and contains no reproducible operational techniques. The real service is a technical-organizational analysis carried out with the client’s prior written authorization and in an agreed environment. © 2026 Cyberfero S.r.l. — All rights reserved.
Customers
Twitter FEED
Recent activity
-
SecureOnlineDesktop
Estimated reading time: 6 minutes L'impatto crescente delle minacce informatiche, su sistemi operativi privati op… https://t.co/FimxTS4o9G
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The growing impact of cyber threats, on private or corporate operating systems… https://t.co/y6G6RYA9n1
-
SecureOnlineDesktop
Tempo di lettura stimato: 6 minuti Today we are talking about the CTI update of our services. Data security is… https://t.co/YAZkn7iFqa
-
SecureOnlineDesktop
Estimated reading time: 6 minutes Il tema della sicurezza delle informazioni è di grande attualità in questo peri… https://t.co/tfve5Kzr09
-
SecureOnlineDesktop
Estimated reading time: 6 minutes The issue of information security is very topical in this historical period ch… https://t.co/TP8gvdRcrF
Newsletter
Products and Solutions
Partners
Cloud Models
News
- From Cyberfero to Cyberfero: rebranding of the leading cybersecurity company May 6, 2024
- NIS: what it is and how it protects cybersecurity April 22, 2024
- Advanced persistent threats (APTs): what they are and how to defend yourself April 17, 2024
- Penetration Testing and MFA: A Dual Strategy to Maximize Security April 15, 2024
- Penetration Testing: Where to Strike to Protect Your IT Network March 25, 2024
Google Reviews
Davvero consigliata !!!!!
In particolare vorrei sottolineare la figura che piu’ racchiude e sintetizza le qualità della Secure Online Desktop , il suo AD Ing. Piergiorgio Venuti, professionista impagabile , sia dal punto di vista tecnico/organizzativo che soprattutto (e non dimeno) come persona , capace di gestire , risolvere e approcciare qualsivoglia attività/problematica, davvero un grande !!!!
Tempi veloci e staff preparato!
Ottima azienda, servizi molto utili, staff qualificato e competente. Raccomandata!read more
Ottimo supportoread more
E' un piacere poter collaborare con realtà di questo tiporead more
Un ottimo fornitore.
Io personalmente ho parlato con l' Ing. Venuti, valore aggiunto indubbiamente.read more
About
© 2024 Cyberfero s.r.l. All Rights Reserved. Sede Legale: via Statuto 3 - 42121 Reggio Emilia (RE) – PEC [email protected] Cod. fiscale e P.IVA 03058120357 – R.E.A. 356650 Informativa Privacy - Certificazioni ISO