Case Summary: 20251022-1

Case Title:

Unauthorized Data Exfiltration via Remote Access Trojan (RAT)

Lead Examiner:

Jordan Chen, CCE

Date of Acquisition:

October 21, 2025

Devices Collected:

• Lenovo ThinkPad T14 (Windows 11 Pro)
• Samsung Galaxy S22 Ultra (Android 13)
• Western Digital 2TB External HDD

Forensic Imaging Tools Used:

• Magnet Acquire v3.5
• FTK Imager v4.5
• Autopsy 4.21.0

Key Findings:

• Presence of NanoCore RAT executable in AppData\Roaming folder
• Outbound traffic to IP 185.203.119.12 flagged by Suricata IDS
• Recovered deleted .docx files containing internal financial projections
• USB activity logs show unauthorized access on October 19 between 2:13–2:45 AM
• Encrypted ZIP archive named “Q4_Review.zip” with password brute-forced using John the Ripper

Chain of Custody:

All devices were sealed, labeled, and logged into evidence using QR-coded tags. Custody maintained by Officer Marielen Montalvo.

Recommendations:

• Full malware reverse engineering of NanoCore payload
• Internal audit of USB access policies and endpoint monitoring
• Legal review of recovered documents for potential breach notification