Pronico TTP Overlap: Standard Playbook or Uncommon Composition?
The main analysis of Guacamaya’s 2021–22 Pronico intrusion maps 67 Enterprise ATT&CK techniques from the operators’ own screen recording. This follow-up asks a narrower question: how much of that behavior was standard enterprise intrusion procedure, and which combinations were less common?
Two earlier bodies of material make useful comparisons: Phineas Fisher’s 2017 Hack Back — A DIY Guide, about the Hacking Team intrusion, and the pentesting manuals archived as material supplied to Conti affiliates. The comparison here is about procedures, not actor identity.
“Standard operating procedure” is not a binary label. A technique can be routine while the order in which it is used, the system on which it is placed, or the problem it solves is unusual. Counting shared ATT&CK IDs alone would flatten those differences.
| Overlap | Comparison | Assessment |
|---|---|---|
| Active Directory, host, group, and share discovery | Across the two sources, the procedures use PowerView, csvde, AdFind, native net commands, and share enumeration. |
Standard Windows-domain post-exploitation. The tools are interchangeable expressions of the same discovery goals. |
| LSASS and browser credential recovery, password spraying, DCSync, and pass-the-hash | Mimikatz and credential-driven movement are central to both sources and to Pronico. | Standard once an operator has sufficient Windows privileges. The important variable is where the recovered identity can reach. |
| PsExec, WMI, RDP, administrative shares, scheduled tasks, services, and process injection | The Conti Cobalt Strike manual presents these almost as a menu; the Hacking Team guide explains their relative reach and visibility. | Standard remote execution and lateral movement. Their presence says little by itself about the operator. |
| Searching administrators’ endpoints for infrastructure access | The Hacking Team guide compromises sysadmins to reach an isolated development network. The Conti admin-hunting material tells operators to inspect administrator browser history, saved credentials, and files for NAS, backup, and virtualization access. | The objective is standard. Using administrators as credential bridges across a newly imposed boundary is a more specific procedural match. |
| Inventorying file shares, staging selected data, and transferring it through a controlled channel | The Hacking Team intrusion used SMB collection through its pivot; the Conti material teaches share discovery followed by rclone; Pronico used an internal staging host and WinSCP over SFTP. |
Standard collection architecture, despite different clients and destinations. |
| Maintaining several independent ways back in | The Hacking Team guide favors high-uptime hosts, stolen passwords, and golden tickets. The Conti material documents scheduled tasks, services, remote-management software, and accounts. | The principle is standard for a sustained intrusion. Pronico’s portfolio across Windows, VPN, routers, an old workstation, and a Fibre Channel switch is unusually broad. |
| Embedded-device pivots, SOCKS forwarding, and DNS as fallback C2 | The Hacking Team guide describes exploiting an embedded appliance, using it as a SOCKS and port-forwarding pivot, and keeping DNS tunnels available for reliable egress. | Established tradecraft, but not the default Windows-enterprise playbook. Compiling a target-specific client for an old PowerPC switch and waiting for hourly DNS callbacks is target-shaped rather than standard. |
| Tunneling iSCSI through compromised infrastructure | In the Hacking Team intrusion, iSCSI was forwarded through the embedded foothold to inspect virtual-machine backups. Pronico later carried iSCSI through several pivots to reach and corrupt SAN disks. | The most distinctive overlap. Protocol tunneling is common; remote iSCSI access through an embedded pivot is not a routine step in most intrusions. |
| Turning management planes into impact mechanisms | Pronico used storage management, Kaspersky administration, Group Policy, Microsoft 365, and native disk tooling. The comparison sources cover some of the underlying administrative mechanisms, especially GPO, but not this combination. | Target-specific. Abuse of valid administrator authority is standard; coordinating several management planes for destruction is not. |
The Conti overlap is broad but mostly conventional. Its manuals describe the Windows enterprise layer visible in many intrusions: enumerate the domain, recover credentials, move through standard administration channels, find valuable shares, stage data, impair defenses, and deploy at scale.
The Hacking Team guide is a closer procedural comparison. Beyond the same Windows techniques, it joins embedded footholds, DNS fallback, SOCKS pivots, iSCSI forwarding, service-account credentials, golden-ticket backup access, and sysadmin hunting into a similar operating model. Several of those ideas are known tradecraft individually. Their combination, and their use to cross storage and administrative boundaries, is less standard.
The best assessment is that Pronico has a conventional core and an uncommon composition. Most of the 67 mapped techniques are normal parts of a mature enterprise intrusion. What distinguishes the operation is the repeated conversion of those techniques into new access paths after defenders changed the environment: a network appliance became DNS persistence, an administrator became a bridge into a separated domain, an old machine secret survived a rebuild, and a storage protocol became a destructive channel.
Sources and scope
- Pronico TTP analysis and ATT&CK mapping
- Pronico page and video timeline
- Hack Back! video
- Hack Back — A DIY Guide (Hacking Team)
- Archived Conti affiliate pentesting materials
- MITRE ATT&CK data and Navigator resources
The comparison uses the behaviors documented in the two guides and the Pronico recording. It assesses procedural similarity and how common each behavior is; it does not make an attribution claim.
#Threat Research #Hacktivism #MITRE ATT&CK #Incident Response