Notes

3/13 Notified by client (Novatech) that funds had fraudulently left their CoinPayments account. It looked like keys may have been compromised but could have been an external attack.
3/22 Client informed us that approx 300K had been removed - had client modify key access requiring user confirmation and limiting IP addresses to those that our (MultiSoft) systems would send from.
Client provided the following extractions that day
1PYqnGE4fzxbwXMQgemBUquYXX3b5p45Dg = 1.72 BTC total
14CLcFZLcWDgoyJCvyLcYcyd97ZrBpdVw8 = 0.52 BTC
bc1qt7234h2edlm8k3sccs6d4zpe33agw8uhffc8ms = 1.175 BTC
They are locating other records for us at this time.
3/26 Notified by client (CCA Trading) that funds had fraudulently left their Coinpayments account in a similar manner. Informed them immediately to make the changes to restrict IP and require user confirmation of transactions outbound.
CCA provided:
133QzTmyiZ92d2myHhuoXHNGW3rsuZJuHS=0.14535740 BTC
0x2b375b602B2ad9a8c60c3Bc9C34E97758973AEF0 = 1.296 ETH
4/23 Further attempts to remove funds from Novatech coinpayments - attempt failed
4/24 DLLs found deployed - decompiling them indicated that they were attempting to target Novatech again - files were removed before anything occurred.
4/26 we found traces of deployments made through Octopus deployment to deploy through an account for [email protected]. ($50K USD lost). This code allowed transactions to be sent from within our firewall thus appearing to be legitimate. Code was again removed. Since Octopus is used for internal deployments we then started checking for external attacks on the Octopus server. Finding none that were directly apparent we then started looking internally to see if there was any issues or concerns.
4/27 Requested Immedion (Network Operations Center) to determine if IP addresses showing in logs on Novatech and CCATrading were used to access our Fortigate VPN. They indicated that 2 of the IPs provided to them were used to access the Fortigate by Mark Kevin Mardo's account. This led us to add tracing to our servers.
4/28-4/30 deployed DUO as a requirement for logging into all web and SQL servers, removed admin permissions on all servers for the suspected intruder and installed Teramind (hidden) on all servers to track all user access and interaction.
4/30 Suspect accessed Dev servers and placed malicious code on to the servers in 2 separate accounts. This was tracked using DUO which indicated that he had accessed the server (DUO is installed on a user's smart phone and we have device tracking). Further Teramind recorded his actions of copying the code to the server into 2 separate directory paths that he had no reason to be in. Files were subsequently deleted by the user; however we recovered the files and decompiled them to find additional malicious code targeting Novatech specifically.