Build what's next with Claude. Secure it with Palo Alto Networks. Discover how.

PHP attacks stopped before Day 1 with Frontier Virtual Patching. Start today.

Major Australasian beverage manufacturer halts SparkRAT trojan attack

When a critical zero-day vulnerability threatened operations, Unit 42 stepped in to contain the breach, determine exposure, and fortify security.

Download PDF

Results

3hours

to identify and isolate affected servers

72hours

to neutralise command and control infrastructure

7days

from initial scoping to completion of investigation

The Client

Major Australasian beverage manufacturer halts SparkRAT trojan attack

The Challenge

A critical zero-day vulnerability in public-facing BeyondTrust software allowed threat actors to bypass authentication and gain administrative control at a beverage manufacturer and distributor. Once inside, they deployed the SparkRAT trojan to establish persistent access, intent on moving laterally to exfiltrate data. Unit 42 stepped in to help:

Contain the breach by isolating affected assets and blocking command-and-control (C2) indicators of compromise (IoCs).
Determine exposure by tracing lateral movement pathways and assessing potential data exfiltration.
Eradicate the threat by removing malware, revoking compromised credentials, and patching the zero-day entry point.
Contain and eradicate the threat.

Unit 42’s Rigorous Incident Response Approach for Superior Outcomes

Assess

Palo Alto Networks Unit 42 Threat Intelligence proactively detected real-time weaponization against public-facing infrastructure that flagged in a Next-Generation Firewall, directly alerting executive leadership to initiate an immediate response.

Investigate

Forensics audited host, network, and cloud VPC flow logs, confirming an authentication bypass via CVE-2026-1731, identifying the SparkRAT payload, and unmasking the adversary's full C2 server infrastructure.

Secure

Analysts mapped outbound C2 beaconing signatures and blocked the threat actor’s primary and secondary VPS IP addresses, permanently evicting the adversary before corporate domain components were compromised.

Recover

Unit 42 achieved full containment and recovery within 3–5 days, preventing any disruption to production or distribution systems.

Transform

Hardened system configurations by enforcing strict egress filtering, preventing web servers from initiating outbound connections to untrusted ASNs, and establishing behavioral threat hunting for anomalous child processes.

First trigger point

Assess

Investigate

Secure

Recover

Transform

Scroll right

Resolution Timeline

Assess

Investigate

Secure

Recover

Transform

Days 0 - 2
Crisis Intervention

Unit 42 proactively detected CVE-2026-1731 exploitation and alerted leadership before internal alerts fired; engagement authorized immediately.

Mapped host and network logs, confirming RCE, downloader activity, and SparkRAT execution establishing outbound C2 over non-standard ports.

Mapped outbound beaconing signatures and isolated the RAT from corporate domain assets.

Days 3 - 5
Decryption

Audited cloud VPC Flow Logs to trace C2 infrastructure pivots.

Discovered secondary malicious IP cluster sharing the same ASN, proving adversary usage of a leased VPS block.

Blocked the entire VPS infrastructure block, neutralizing the adversary's C2 footprint.

Verified complete containment with zero operational impact, zero lateral movement, and zero data exfiltration.

Days 6 - 14
Restoration

Continuous threat hunting across EDR/XDR telemetry to confirm no remaining persistence mechanisms.

Applied updated signatures and endpoint policies across all public-facing BeyondTrust appliances.

Full system validation completed with normal operational status maintained across all sites.

Days 15 - 30
Fortification

Implemented automated VPC Flow Log auditing for foreign/high-risk ASN risk markers.

Enforced strict egress filtering constraints on web servers and established behavioral detection for web server child processes.

Last trigger point

Threat-informed Incident Response

With Unit 42 Incident Response, stay ahead of threats and out of the news. Investigate, contain and recover from incidents faster and emerge stronger than ever before, backed by the full power of the world’s leading cybersecurity company. Partner with us to gain peace of mind.

Backed by Industry’s Best

Threat Intel
Extensive telemetry and intelligence for accelerated investigation and remediation.
Technology
Palo Alto Networks platform for in-depth visibility to find, contain and eliminate threats faster, with limited disruption.
Experience
Trusted experts who mobilize quickly and act decisively in over 1K incidents per year