Pronico TTP Overlap: Standard Playbook or Uncommon Composition?

Wed, 09 Sep 2026 08:30:00 +0200

The main analysis of Guacamaya’s 2021–22 Pronico intrusion maps 67 Enterprise ATT&CK techniques from the operators’ own screen recording. This follow-up asks a narrower question: how much of that behavior was standard enterprise intrusion procedure, and which combinations were less common?

Two earlier bodies of material make useful comparisons: Phineas Fisher’s 2017 Hack Back — A DIY Guide, about the Hacking Team intrusion, and the pentesting manuals archived as material supplied to Conti affiliates. The comparison here is about procedures, not actor identity.

When the Intruders Publish Their Screen Recording: Guacamaya's Pronico TTPs

Tue, 08 Sep 2026 20:00:00 +0200

We do not often get to see how an intrusion was actually worked.

Most public reports begin after the fact. They give us a timeline assembled from logs, a list of malware, and perhaps a clean attack-flow diagram. What disappears is the operator: the wrong commands, improvised workarounds, changes of plan, concern about being detected, and the response when defenders begin closing doors.

This case is different. On 6 March 2022, Guacamaya published a 2 hour 23 minute screen recording of its intrusion into Compañía Guatemalteca de Níquel (CGN) and Compañía Procesadora de Níquel de Izabal (Pronico), the mining and processing companies then behind Guatemala’s Fenix nickel project. The visible timeline begins on 7 April 2021 and reaches February 2022, although Guacamaya describes the active operation as lasting six months.

Incident Response on Martin's Blog

Pronico TTP Overlap: Standard Playbook or Uncommon Composition?

When the Intruders Publish Their Screen Recording: Guacamaya's Pronico TTPs