Cisco and Splunk Agentic SOC at .conf26 detects fake-Corepack npm infostealer C2 traffic from a compromised attendee laptop
Cisco and Splunk ran a live Agentic SOC at Splunk .conf26, combining Cisco Cloud Control, Splunk Enterprise Security (ES), Cisco Talos intelligence and Endace continuous packet capture, with Jamf engineers also on the team. The article is largely a product and event retrospective. Its one security incident was a fake-Corepack npm credential-theft and proxyware campaign. A Tier 1 analyst using the ES Triage Agent was alerted to an anomalous outbound connection to moonlighthathel[.]org, which Talos identified as an active command-and-control (C2) node. The investigation mapped the malware across 15 venue endpoints and used Endace packet capture to verify the encrypted C2 payload. The NOC located the affected attendee, a Splunk customer whose laptop arrived already compromised, and quarantined it. The attendee was then guided through on-site remediation, credential rotation and session invalidation.
Technical Details
- Detection path: the Splunk Triage Agent raised the alert, and Cisco Talos enrichment tied the domain to the fake-Corepack npm campaign.
- Scope: the correlation graph showed the malware on 15 venue endpoints.
- Verification: Endace packet capture confirmed the encrypted C2 payload in flight.
- Localization: DHCP bindings and wireless access point telemetry were used to find the device on the show floor.
- The article gives no hashes, package names or further IOCs beyond the C2 domain, and no attribution.
Remediation
- The affected host was quarantined from the network.
- The user completed credential rotation and session invalidation.
- The article presents human-governed containment decisions as the model, with AI agents handling triage and enrichment.
Linha do tempo
-
Cisco and Splunk Agentic SOC at .conf26 detects fake-Corepack npm infostealer C2 traffic from a compromised attendee laptop
ler a análise desta fonte ocultar
Cisco and Splunk ran a live Agentic SOC at Splunk .conf26, combining Cisco Cloud Control, Splunk Enterprise Security (ES), Cisco Talos intelligence and Endace continuous packet capture, with Jamf engineers also on the team. The article is largely a product and event retrospective. Its one security incident was a fake-Corepack npm credential-theft and proxyware campaign. A Tier 1 analyst using the ES Triage Agent was alerted to an anomalous outbound connection to moonlighthathel[.]org, which Talos identified as an active command-and-control (C2) node. The investigation mapped the malware across 15 venue endpoints and used Endace packet capture to verify the encrypted C2 payload. The NOC located the affected attendee, a Splunk customer whose laptop arrived already compromised, and quarantined it. The attendee was then guided through on-site remediation, credential rotation and session invalidation.
Technical Details
- Detection path: the Splunk Triage Agent raised the alert, and Cisco Talos enrichment tied the domain to the fake-Corepack npm campaign.
- Scope: the correlation graph showed the malware on 15 venue endpoints.
- Verification: Endace packet capture confirmed the encrypted C2 payload in flight.
- Localization: DHCP bindings and wireless access point telemetry were used to find the device on the show floor.
- The article gives no hashes, package names or further IOCs beyond the C2 domain, and no attribution.
Remediation
- The affected host was quarantined from the network.
- The user completed credential rotation and session invalidation.
- The article presents human-governed containment decisions as the model, with AI agents handling triage and enrichment.