Whispers on the Wire

Wowza Enterprise's SOC (WOWZA-CERT) detected anomalous traffic on their unsegmented office network. Two Windows Server 2022 hosts: APP-SRV-01 (application/deployment server) and DB-SRV-02 (PostgreSQL database server) were compromised via a supply-chain attack on a deployment dependency. The attacker pivoted using reused local admin credentials. The SOC recovered a binary from both hosts (implant.exe) and a packet capture from the network segment.