Lab 2.B · Enrichment · 105 min
Trigger

A credential dump
names your organisation

An aggregated dump has surfaced containing an address at Quillon Grid. Establish whether anything in it is real, whose it is, and whether it still matters.

You are given
m.halden@quillongrid.com — Marek Halden, Control Systems, senior engineer, joined 2019.

No query run. Start with the identifier you were handed.

Debrief — open after the lab

The dead end was the lab

m.halden@quillongrid.com returns nothing, and the corporate domain shows zero exposed accounts. A student who searches the identifier they were handed and stops will report Marek Halden clean — and it will have felt entirely reasonable.

He joined in 2019 as an external contractor, on the legacy quillongrid.net domain. He converted to staff in 2022 and was issued a .com address. The exposure is on the account everyone forgot, including him.

The chain

One password, set on a hobby forum in 2019, still opening a live corporate portal five years later.

SYNTH-HobbyForum-2019 SYNTH-Aggregated-2024 infostealer_infection portal.quillongrid.net/login

The infection is on a personal machine. Corporate EDR has no visibility there — this is the external ~40 % doing what internal telemetry structurally cannot.

The trap

A second mhalden posts on a carding-adjacent forum. It is not him, and the evidence is available to anyone who checks: the account registered in 2014, two years before our subject first used the handle, posting in Portuguese from UTC−03.

A student who reports this as a CI or IDEO finding has collected well and failed the disambiguation. Selectors carry a type, and a username carries no guarantee of uniqueness.

What the absences mean

No sanctions match, no PEP, no cryptocurrency, no company officerships. Those nulls are findings and belong in the Lab 2.C mapping with a source grade — not omitted as blanks.

Grading

1Pivoted to the legacy surface, found the infection, and identified the forum account as a different person. Full marks.
2Pivoted and found the infection, but attributed the forum account to the subject. Good collection, failed disambiguation — the common outcome.
3Searched the corporate address only and reported clean. The failure this lab exists to produce.

Score the collection log as well as the finding. A log with null results recorded is a better artifact than one showing only hits — it is the difference between "I found nothing" and "I looked, here, at this time, and there was nothing."