Here's the info I have put together on IOCs. The sheet also contains a link to a gdrive share containing an archive of the file drops and a screenshot. I've got more stuff to go through, if I find anything else interesting I'll add it to the list. I bolded stuff I thought might be the most useful. Based on the files captured, it appears that hackers in both instances set up tunnels with lots of random traffic coming through, possibly for reselling bandwidth. The hacker we booted from the network on Saturday was setting up a new mail server when they got kicked, probably for perpetuating more phishing attacks. The folder called node-m in the attached archive has their mail server configuration and scripts. Nothing in the archive came back with a positive detection, still be careful! I tried to redact all the user data, but I'm not 100% sure I got all of it so please treat the information as confidential.
If you have any questions please let me know!
Eric B.
