Public reports about cyberattacks often present a polished picture—threat actors working methodically through a well-planned playbook with every action perfectly executed.

This perception leads many to believe that modern attackers operate with machine-like precision, seamlessly moving from one objective to another without facing obstacles.

However, this narrative masks a much different reality that becomes clear when examining the actual evidence left behind on compromised systems.

A closer look at Windows Event Logs and endpoint detection and response (EDR) telemetry reveals something far more human: threat actors struggle, experiment, make mistakes, and adapt when their plans fall short.

![Alt text[(https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZsYjVuaO_nCHWWab4-lEG_Mjn1LnTDtKV_N2YHl-S665HnzjHw92rJcXJNWNfC9D06IfaMdamVx1n9HqZhUGptrKmcfLHu0Zyu7KqvmNdtxMhQE9e7GYyDNbMDcpdqgmEHqCfqyrBa-CII95Rhvvw_aIagmv_ND-NnI9g3WeUDorPAxMFH-9g2fMuiqg/s16000/Whoami.exe%20process%20lineage%20(Source%20-%20Huntress).webp)

Between November and December 2025, three separate cyberattack incidents uncovered by security researchers demonstrated exactly how trial and error shape real-world malware campaigns.

These incidents shared a common theme—attackers leveraging web application vulnerabilities to gain initial access, then attempting to deploy custom malware while continuously adjusting their tactics in response to defensive systems.

The incidents involved a residential development firm, a manufacturing company, and an enterprise shared services organization.

Across all three targets, the attackers exploited flaws in web applications running on Microsoft Internet Information Server (IIS) to execute commands remotely.

Huntress analysts identified a Golang Trojan named agent.exe at the core of these attacks, though the attackers also deployed variations including SparkRAT and other tools to achieve persistence on targeted systems.

What made these attacks particularly noteworthy was not their sophistication, but the evidence of learning and failure.

Alt text)

In the first incident, the threat actor faced immediate detection when attempting to download malware using Windows Defender—so in subsequent attacks, they modified their approach by pre-emptively adding Windows Defender exclusions before deploying their payload.

This pattern demonstrates that threat actors respond to roadblocks rather than executing perfect plans.

The attackers repeatedly attempted to establish persistence using Windows services, yet these efforts frequently failed due to configuration errors and system limitations.

Despite these setbacks, the threat actors persisted, returning to compromised endpoints multiple times with different tools and methods, each attempt revealing their frustration with defensive barriers.

Infection Mechanism

Huntress analysts identified that all three incidents began with the same fundamental vulnerability pattern—compromised IIS web server processes executing attacker-controlled commands.

The threat actors didn’t use traditional web shells; instead, they exploited coding flaws directly within web application pages to achieve remote command execution.

In the first incident, server logs showed a POST request to a login page returning a success status code (200), immediately followed by execution of the whoami.exe command through the web server process.
Alt text

This indicated the attacker had found a vulnerability allowing arbitrary command execution without requiring a web shell upload. The threat actor then issued standard enumeration commands: netstat, user account checks, and network configuration queries.

When attempting to download malware using certutil.exe—a common Living Off The Land binary technique—Windows Defender blocked the command.

Rather than abandoning the approach, the threat actor transferred a file named 815.exe through an unknown mechanism and tried executing it three times before finally succeeding, only to face isolation after the executable was identified as a Golang-written Trojan.

In subsequent incidents, the attackers learned from failure. They issued PowerShell commands to add exclusions for common malware file extensions before deploying malware:

  • powershell -command Add-MpPreference -ExclusionPath C -ExclusionExtension .exe, .bin, .dll -Force*

This adaptation proved critical, as it demonstrated threat actors modifying behavior based on previous setbacks, even as they continued reusing the same flawed persistence mechanisms that failed in earlier attempts.