Advanced Threat Hunting Case Study in BFSI Sector

This case study details an engagement by CyberProof with a leading financial services organization in South Africa, focusing on advanced threat hunting to uncover risks associated with digitally signed ConnectWise installers. The client faced challenges related to suspected supply chain compromises and detection gaps in their existing endpoint detection and response (EDR) controls. CyberProof's MXDR team identified suspicious outbound network connections linked to a potential attack by a nation-state APT group. The investigation revealed the use of Authenticode stuffing, where a modified installer retained a valid digital signature while embedding malicious code. This proactive threat hunting approach allowed for early risk discovery and the closing of detection gaps, ultimately strengthening the client's security posture against similar threats. The findings led to actionable recommendations that improved endpoint detection and reduced exposure to future supply chain attacks. The collaboration emphasized the importance of integrating threat intelligence with existing security measures.