# Draft post-incident report — INC-2026-0905

*This is a draft assembled from stored records. Nothing in it has been adopted, approved or signed off by anyone. Adoption is a registered action that goes through policy evaluation and leaves its own audit record; if this document were adopted, that record — not this file — would be the evidence of it.*

- **Incident:** `INC-2026-0905`
- **Document:** post_incident (draft)
- **Generated:** 2026-10-30T06:00:56.946072+00:00
- **Source:** https://265d0hsmwa.execute-api.us-east-1.amazonaws.com/api/v1/incidents/INC-2026-0905/draft/post_incident/export

## What happened *(draft)*

- A destructive wiper arrived inside a trojanised vendor update, took svc-deploy's credentials out of memory, spread to fs-04 and dc-01 both with those credentials and by exploiting an unpatched SMB service, and overwrote boot records behind a ransom note that cannot be paid. (confidence 0.94)
  - *evidence:* `INC-2026-0905#hypothesis-0`, `SEC-0005-a`, `SEC-0005-b`, `SEC-0005-c`, `SEC-0005-d`, `SEC-0005-e`, `SEC-0005-g`, `SEC-0005-i`
- host:fin-034 — a binary outside the vendor manifest, through the signed update channel
  - *evidence:* `INC-2026-0905#chain-0`, `SEC-0005-a`, `SEC-0005-b`
- account:svc-deploy — deployment credentials read out of process memory
  - *evidence:* `INC-2026-0905#chain-1`, `SEC-0005-c`
- host:fs-04 — written to over ADMIN$ with the stolen credentials
  - *evidence:* `INC-2026-0905#chain-2`, `SEC-0005-d`
- host:fs-04 — malformed SMBv1 transaction against the unpatched service
  - *evidence:* `INC-2026-0905#chain-3`, `SEC-0005-e`
- host:fs-04 — boot record overwritten with no copy kept, and a reboot scheduled
  - *evidence:* `INC-2026-0905#chain-4`, `SEC-0005-f`, `SEC-0005-g`

## What was ruled out *(draft)*

- Ruled out: Ransomware. The data is encrypted and recoverable — pay the demand or wait for a key.
  - *evidence:* `INC-2026-0905#hypothesis-1`, `SEC-0005-i`, `SEC-0005-g`

## What was done *(draft)*

- Nothing was executed. The plan was drawn up and did not run.
  - *evidence:* `INC-2026-0905`

## What was verified *(draft)*

- No verification is recorded, so nothing here says the incident was resolved rather than merely closed.
  - *evidence:* `INC-2026-0905`

## Provenance

Every assertion above cites the records it rests on; 16 distinct reference(s) in total.

Audit records for this incident, against which the above can be reconstructed:

- `2026-10-19T00:23:18.417408+00:00 · escalation · dharma — escalated — isolate_host scores 67 → senior tier, and the plan touches a domain controller`
- `2026-10-19T00:23:18.417402+00:00 · observation · agent:analyst — diagnosed — the ransom note is contradicted by the installation ID and by the overwritten boot record — this destroys rather than encrypts`
- `2026-10-19T00:23:18.417394+00:00 · observation · agent:sentinel — correlated — update fetch, unlisted binary, credential read and admin-share writes to two hosts inside eleven minutes`
- `2026-10-18T23:24:18.416639+00:00 · observation · drishti — the installation ID is random bytes rather than anything derived from a key, and no key material left the host — there is nothing the fixed address could decrypt in exchange`
- `2026-10-18T23:23:18.416639+00:00 · observation · drishti — a note demanding 300 USD of bitcoin to one fixed address, carrying an installation ID for the victim to send back`
- `2026-10-18T23:18:18.416639+00:00 · observation · drishti — the first sector of fs-04's system disk was overwritten and the original master boot record was not copied anywhere on the volume`
- `2026-10-18T23:13:18.416639+00:00 · observation · drishti — a scheduled task was registered on fs-04 and dc-01 to reboot in fifty-seven minutes`
- `2026-10-18T23:06:18.416639+00:00 · observation · drishti — fs-04 accepted a malformed SMBv1 transaction from fin-034 of the shape used to execute code on an unpatched service`
- `2026-10-18T23:03:18.416639+00:00 · observation · drishti — fin-034 wrote to ADMIN$ on fs-04 and dc-01 within forty seconds, authenticating as svc-deploy; it had contacted neither before`
- `2026-10-18T22:59:58.416639+00:00 · hypothesis · buddhi — Ransomware. The data is encrypted and recoverable — pay the demand or wait for a key. (6%) · ruled out by SEC-0005-i, SEC-0005-g`
- `2026-10-18T22:59:58.416639+00:00 · hypothesis · buddhi — A destructive wiper arrived inside a trojanised vendor update, took svc-deploy's credentials out of memory, spread to fs-04 and dc-01 both with those credentials and by exploiting an unpatched SMB service, and overwrote boot records behind a ransom note that cannot be paid. (94%)`
- `2026-10-18T22:58:18.416639+00:00 · observation · drishti — that binary read lsass memory; svc-deploy's deployment credentials were recovered in cleartext`
- `2026-10-18T22:55:18.416639+00:00 · observation · drishti — the updater wrote and launched a binary the vendor's published manifest for 7.4.11 does not list`
- `2026-10-18T22:53:18.416639+00:00 · observation · drishti — fin-034 fetched build 7.4.11 from the vendor update endpoint at 192.0.2.30 — signed, on schedule, and indistinguishable from every other Tuesday`

*Exported documents do not update. An incident can reopen, a verification can land and an execution can be rolled back after this was written, and nothing on this page would show it. Check the references against the source before relying on it.*

*Adopting this would require the registered action `adopt_report`, which is scored and routed through policy evaluation like any other action. This file is not that.*