Cyber-Attack-Analysis

Cybersecurity Case Study: The 2020 Virgin Mobile KSA Breach 📌 Executive Summary In 2020, a significant security incident compromised Virgin Mobile KSA, leading to the theft of sensitive data including employee communications and personal information of over 1,000 users. This repository provides a comprehensive breakdown of the attack vector, the technical vulnerabilities exploited, and the strategic failures that led to the exfiltration of data later sold on the dark web.

🔍 Attack Breakdown (The "How It Worked") The breach was a classic example of Initial Access via Unpatched Vulnerabilities followed by Internal Network Sniffing.

Primary Exploit: Attackers targeted CVE-2020-0688 in unpatched Microsoft Exchange servers.

Methodology: Once inside, they deployed Packet Sniffing tools to intercept unencrypted internal communications.

Exfiltration: Capturing high-value assets including employee credentials, internal emails, and customer activation reports.

⚠️ Strategic Impact & Analysis

The "Productivity" Trap: The company prioritized uptime over security, intentionally delaying critical patches to maintain "productivity"—a decision that resulted in catastrophic reputational damage.

Exposure: High-stakes leakage of sensitive corporate and customer files on the dark web.

🛡️ Proposed Defense Architecture To mitigate such sophisticated threats, a multi-layered security posture is essential:

Rigorous Patch Management: Implementing an automated protocol via tools like WSUS or SCCM to ensure zero-day threats are addressed immediately.

Network Encryption (Zero Trust Approach): Enforcing HTTPS/TLS for all internal traffic to render packet sniffing useless, combined with monitoring tools like Snort or Wireshark.

Advanced Identity Protection: Deploying Multi-Factor Authentication (MFA) to neutralize the risk of stolen credentials.

Prepared by: Wajd Alharbi.