When the Intruders Publish Their Screen Recording: Guacamaya's Pronico TTPs

We do not often get to see how an intrusion was actually worked.

Most public reports begin after the fact. They give us a timeline assembled from logs, a list of malware, and perhaps a clean attack-flow diagram. What disappears is the operator: the wrong commands, improvised workarounds, changes of plan, concern about being detected, and the response when defenders begin closing doors.

This case is different. On 6 March 2022, Guacamaya published a 2 hour 23 minute screen recording of its intrusion into Compañía Guatemalteca de Níquel (CGN) and Compañía Procesadora de Níquel de Izabal (Pronico), the mining and processing companies then behind Guatemala’s Fenix nickel project. The visible timeline begins on 7 April 2021 and reaches February 2022, although Guacamaya describes the active operation as lasting six months.

The accompanying page says the recording covers the initial Exchange compromise, data theft, repeated sabotage, the company’s rebuild, and the operators’ return. The video is called Hack Back! A DIY Guide to Digital Monkeywrenching.

That makes it a rare primary source. It is also a source with an agenda. The recording was made by the intruders, edited by the intruders, and framed around their political objective. It is evidence of what they chose to show, not an independent incident report.

I worked from two transcripts: a detailed frame transcription and a second pass sampling the complete video every ten seconds. I mapped every behavior I could defend to Enterprise ATT&CK v19.2. I did not repeat the passwords, public IP addresses, or destructive command lines visible in the source. They add nothing to the analysis.

The map contains 67 techniques. That number is not a sophistication score. It mostly reflects the extraordinary amount of the operation that was put on screen.

The operation, briefly

The clean version of the story is Exchange to domain admin to data theft to destruction. The real version is more interesting.

The sequence matters, but it is not a straight line. Access, collection, persistence, and impact repeat. Defenders changed the environment; the operators observed those changes and altered their tooling.

From one Exchange server to the domain

The initial compromise was almost the least interesting part. An Nmap script identified the Exchange Server-Side Request Forgery vulnerability, and the operators used the ProxyLogon chain to place an ASPX web shell and start a reverse HTTPS Meterpreter session.

The important event came next. Mimikatz (via Meterpreter’s kiwi extension) dumped LSA secrets and exposed the password of a service account that was already in Domain Admins. There was no long privilege-escalation chain. A secret stored on the first compromised server collapsed the boundary between one Exchange host and the whole domain.

The operators then exported Active Directory with csvde, searched the output for Windows Server 2012 systems, and tested which hosts were alive. The choice of older servers was deliberate: the captions say they wanted systems without AMSI, where PowerShell activity would be easier. PsExec moved the session to an internal server, Meterpreter added routes, and a SOCKS proxy made the rest of the network reachable.

This is the first recurring pattern in the recording: each new position was used to acquire a quieter or more durable one. Exchange was an entry point, not a home.

Persistence was a portfolio

The recording does not show one carefully protected implant. It shows several independent bets.

The operators scanned for Telnet and found a Fibre Channel switch using its default root password. Its old PowerPC Linux environment complicated payload development, so they built an older dnscat client compatible with the device, hard-coded its settings, and placed it in cron.hourly. The listener could remain offline until access was needed. At worst, the operators expected to wait an hour for the switch to call home over DNS.

They also forged golden tickets, compromised an old off-domain Windows XP system with EternalBlue, collected VPN credentials, and later backdoored routers and other embedded devices. None was individually guaranteed to survive. Together they made remediation much harder.

The most instructive part arrives after the first rebuild. The defenders changed the krbtgt password, which invalidated the golden tickets. They did not change a domain-controller machine-account password already held by the operators. Guacamaya says it used that machine hash for DCSync and recovered the replacement domain credentials.

The Windows domain had been rebuilt. The trust material around it had not been rebuilt completely.

Credential access drove the campaign

The operation kept turning administration into intelligence.

On a sysadmin workstation, the operators enabled WDigest and used Mimikatz to recover credentials from memory. They searched desktop files, browser stores, and browser history. The result was not only more Windows access. It included VPN, routers, printers, network management, cloud services, and SAN administration.

When Mimikatz and LaZagne did not recover the Chrome material they wanted, they tried another project, fixed its handling of newer Chrome records, and continued. When Defender objected to an in-memory launcher, they changed the host process. The captions even note that remote DPAPI collection would have been quieter than placing another agent on the workstation.

Later, after the Hyper-V systems had been moved into a separate domain, Guacamaya reduced Mimikatz to the code needed for RDP credential recovery. The stated goal was to watch administrators cross the new boundary and steal the credentials they used there. That worked.

This is the second recurring pattern: administrative movement joined environments that network segmentation had separated.

Collection was deliberately staged

The operators inventoried SMB shares with a tool already installed on the administrator’s workstation. They identified important employees, searched their computers, and used Group Policy to enable file sharing on desktops that did not expose it by default.

An old server with little interactive use became the staging host. That choice was not accidental. The captions say it was selected because activity there was less likely to be noticed.

WinSCP was uploaded, timestomped, renamed to resemble another component, and driven with a temporary script. Documents moved from network shares to the staging server and then to an external SFTP service. For email, selected Exchange mailboxes were exported to PST, moved away from the Exchange server quickly, and sent from the staging system. Completed export requests, temporary files, and event data were cleaned up.

The workflow is ordinary enough to evade a product looking only for malware:

1. use privileged, built-in export functions;
2. move data over administrative shares;
3. stage it on a quiet internal server;
4. exfiltrate over encrypted SFTP; and
5. delete the obvious working files.

The individual tools are less useful detection points than the sequence.

The administrators’ tools became the impact mechanism

The first destructive activity went directly after storage. Guacamaya logged into HP MSA storage systems with recovered credentials and deleted volumes. A Hyper-V host whose disk was not on the SAN was handled separately through remote WMI and the Windows disk-management stack.

After the company rebuilt, the operators returned through existing access. They authenticated to the Kaspersky administration console as a domain administrator, installed the endpoint plug-in that exposed a wipe function, and created a mass task against employee systems. Servers were treated differently: remote WMI launched native formatting, with SDelete used where mounted files prevented a volume-level operation.

Cloud administration followed the same pattern. Microsoft 365 PowerShell modules were used to remove users, empty deleted-user state, delete SharePoint sites, and permanently remove mailboxes. Some commands failed, throttling slowed others, and the recording shows the operators adjusting syntax and order until the work continued.

BitLocker was then deployed through Group Policy. A first task installed the feature across the domain; a later scheduled task started encryption with attacker-controlled passwords. Reboot and shutdown actions attempted to turn partial encryption into immediate loss of access.

This is not exploitation in the usual sense. Kaspersky, Group Policy, Exchange, Microsoft 365, WMI, and the SAN controller did what authenticated administrators asked them to do. The security boundary that mattered was control of the administrator identity.

Watching the defenders, then changing the tools

The recording includes a rare feedback loop between attacker and defender.

The sysadmins noticed mailbox artifacts, so later exports were moved away from Exchange faster. They searched recently modified files, so implant timestamps were copied from old files. They restricted internet access, leaving DNS available, so the operators standardized on DNS tunnels. They separated the Hyper-V environment, so the operators harvested RDP credentials from administrators crossing into it.

The tooling changed too. Guacamaya removed diagnostic strings from dnscat2, built a service DLL intended to live inside svchost, and made target-specific binaries that checked the expected environment before running. The objective was not elegant malware. It was to make familiar open-source code look unfamiliar to antivirus.

One attempt failed in a useful way. Repeated service creation from a PowerShell-spawning implant caused Kaspersky to kill and classify that build. Guacamaya’s conclusion was that the behavior, rather than the bytes alone, exposed it. A nearly unchanged rebuild survived when used differently.

That is as close to a controlled detection experiment as an intrusion recording is likely to give us.

The ATT&CK map

The visualization uses the current Enterprise ATT&CK v19.2 tactics, including the new Stealth and Defense Impairment split. A selected technique means that the recording supports the behavior; color and marker shape show the evidence tier, not frequency, severity, or confidence in Guacamaya’s wider claims.

The map is portrait-oriented; click it to open the full-size SVG.

Download the ATT&CK Navigator layer. It includes the evidence note behind every selected technique.

A note on evidence, because it matters here:

• Video-confirmed means the command, output, or GUI action is visible in the recording.
• Caption-reported means Guacamaya describes the action in an on-screen caption, but the action itself is not visible.
• ATT&CK-inferred means the behavior is visible, while the ATT&CK interpretation requires a small analytical step.

For 61 of the 67 techniques, the supporting command, output, or GUI action is visible on screen. Five are caption-reported and one is ATT&CK-inferred.

The complete mapping is below. Multi-tactic techniques appear where ATT&CK v19.2 places them, but are counted once in the 67-technique total.

† Caption-reported · ‡ ATT&CK-inferred · unmarked techniques are video-confirmed.

What I would detect first

There are dozens of possible detections here. The useful ones sit at control points the operators could not avoid.

Several of those signals are independent of the payload. That is the point. A target-specific dnscat2 build may defeat a hash rule. It does not make a switch into a normal DNS client, a workstation into a domain replication partner, or an unused application server into a normal exporter of terabytes.

What the recording changes

The temptation is to describe this as a destructive intrusion that used ProxyLogon. That misses most of the lesson.

The decisive capability was the ability to keep converting one kind of access into another: server to service account, service account to domain, domain admin to network-device credentials, device credentials to durable pivots, sysadmin workstation to infrastructure credentials, and administration tools to fleet-wide impact.

The defenders did many sensible things. They restricted egress, reduced VPN access, rotated krbtgt, rebuilt the domain, separated Hyper-V, and isolated storage. Each action removed a route. The operation continued because the response did not revoke every identity and management path that crossed the new boundaries.

The practical lesson is not “block dnscat2” or “detect Mimikatz.” It is to know which credentials can turn one compromised system into control of an environment, which management systems can perform irreversible actions, and which non-Windows devices can quietly preserve network access after the Windows estate has been rebuilt.

Most incident reports show us what survived collection. This recording shows something rarer: how an operator thinks while the incident is still moving.

Sources and scope

• Pronico page, video timeline, and external coverage
• Hack Back! video
• MITRE ATT&CK version history
• ATT&CK data and Navigator resources

The source video was public before this analysis. The mapping is based on the supplied transcripts and current ATT&CK definitions. It does not independently verify Guacamaya’s attribution, every claimed action, the completeness of the recording, or the wider political narrative.