i³ Threat Advisory: Insider Sabotage: Logic Bomb Detection and
Post-Termination Monitoring

Executive summary (TL;DR):

• This advisory examines insider sabotage, including a logic bomb planted inside on-premises Active Directory.
• This matters now because generative AI compresses the time between grievance and working malicious code.
• Risk is highest for privileged insiders, such as engineers, during layoffs, restructures, and offboarding.
• In this investigation, a 60-day post-termination review surfaced the script before it triggered.
• Primary risks include mass Active Directory account deletion and credential exposure through social engineering.
• Organizations should prioritize generative AI conversation monitoring and behavioral detection on servers.

Threat overview

Engineers hold deep access to the systems an organization runs on, along with the technical knowledge to work around the controls placed on them. That combination is what makes the role valuable, and what makes it dangerous when intent shifts. An engineer acting against their employer — through data theft, system sabotage, or unauthorized access — can cause operational disruption, financial loss, and reputational damage at the same time.

Working with affected organizations, DTEX has observed post-termination activity by DPRK-affiliated IT workers (ITWs) targeting critical infrastructure inside a blockchain entity. After dismissal, these individuals attempted to regain access to the organization’s main database and execute malicious code intended to sabotage the system. The attempt failed because the employer revoked access privileges in time.

That activity fits broader patterns attributed to DPRK cyber operations. The DPRK-linked threat group APT45, also known as Andariel, has a documented history of destructive and sabotage-oriented campaigns. The group is closely associated with ITW operations and has demonstrated capability that extends past espionage into direct system disruption.

One example is the attempted compromise of India’s Kudankulam Nuclear Power Plant, where malware containing hardcoded internal credentials was discovered. The attack was thwarted, but it shows the severity these operations can reach. Another campaign attributed to the group is DarkSeoul, which targeted South Korean media and financial institutions and disabled more than 48,000 systems in a coordinated destructive effort.

Key aspects of sabotage in insider risk

Sabotage is deliberate action taken by someone inside an organization to disrupt, damage, or destroy its operations, assets, or reputation. From an insider risk perspective it is a difficult problem because the people carrying it out hold legitimate access to the resources and systems involved, which makes detection and prevention harder.

Motivation: People engage in sabotage for personal grievances, ideological beliefs, financial gain, coercion or blackmail, or competitive advantage. Understanding what drives the behavior is central to mitigating it.

Access and knowledge: Insiders generally understand the organization’s processes, systems, and weak points better than an external actor does. That understanding lets them exploit gaps more effectively, which makes the resulting sabotage more damaging.

DTEX investigations and indicators

During a routine 60-day post-termination review, DTEX Platform was used to identify a critical insider threat involving a former engineer at a Top 2000 organization. The investigation uncovered a logic bomb embedded in the company’s on-premises Active Directory (AD), built to delete the entire user base once the engineer’s own account was removed.

The individual had recently been affected by organizational layoffs and sat within a team undergoing restructuring. Because of the nature of their role, the activity initially looked consistent with normal job functions, which complicated early detection. Behavioral records showed a history of interpersonal conflict and dissatisfaction with management alongside strong technical performance.

Evidence suggests the engineer anticipated the layoff and used an AI chat tool to help script the malicious code. The credentials needed to execute it came from unauthorized access to a penetration testing report obtained through social engineering. The script carried two separate triggers, both set to fire on termination of the engineer’s account.

The case shows why insider threat detection, post-termination monitoring, and strict access controls matter most for employees with elevated privileges and technical capability.

Stage: Investigation (60-day triage)

The organization’s process for triaging a terminated employee starts by identifying the user account, then reviewing their Escalated Behaviors on the Alerts Page.

Clicking the username on the left returns a 30-day overview. 

Applying the relevant filters and setting the time window to “Last 60 days” holds the review to the minimum scope defined for terminated employees.

The first lead was the volume of Escalated Behaviors for generative AI chat websites.

Stage: potential risk indicator
(generative AI research)

The organization permitted generative AI use under a policy limiting activity to a predefined list of approved sites and tools intended to support workflow efficiency. The policy was not backed by technical controls or monitoring.

Generative AI usage by this individual rose sharply in the weeks before termination, as shown in the figure below. The user reached a wide range of AI platforms, many of them outside the approved list.

A review of the AI conversations shows the user actively seeking help accessing the organization’s Active Directory, which points to intent to bypass internal security protocols.

Of particular concern is the user’s engagement with a Chinese-based large language model (LLM), which raises additional questions about data exposure and compliance with organizational and regulatory standards.

Stage: investigation
(generative AI research)

Analyst note: it is presumed the user intentionally accessed a Chinese-based and non-approved generative AI platform in an attempt to evade organizational monitoring controls.

With the investigation now centered on the insider’s efforts to reach the organization’s servers, the team refocused on the period of heightened generative AI activity and the escalated behaviors around it. That line of inquiry produced several key discoveries and required collaboration with the organization’s cybersecurity team for deeper forensic work.

Stage: circumvention
(local virtual machine creation)

The current engineering team confirmed that virtual machines (VMs) were used occasionally, typically a single VM for testing unstable code, with most development and testing done directly on corporate-issued machines.

The insider’s activity showed configuration and deployment of multiple VMs, which sat well outside that norm. One of them appeared to simulate a virtual Active Directory environment, suggesting it was used to build or test malicious scripts.

Stage: circumvention
(malicious script development)

The cybersecurity team ran forensic analysis across the VMs, prioritizing them by usage patterns. Malicious script development was found in the first VM image analyzed. The script checked for the presence of the insider’s domain user account; if the account was absent, it would trigger mass deletion of all AD user accounts.

To validate its functionality, the script was executed safely in a non-production environment with a DTEX Forwarder installed on the server to monitor behavior. The test confirmed both intent and operational capability.

After recovering the script, the team scanned organizational servers for similar filenames and code patterns. The same script was found sitting on an AD server.

Stage: potential risk indicator
(further generative AI research)

Continued review of escalated behaviors surfaced a detection for Suspicious GitHub Activity. The user had searched for tools capable of scanning for vulnerabilities in a Windows environment.

The detection system did not flag this activity directly, but it fell within the same window as the other suspicious behavior. During that period, investigators identified a GitHub repository — https://github.com/djrk01/windowsattackstuff/tree/main/Destruction — containing scripts structurally similar to the malicious code recovered from the insider’s virtual machine. The finding supports the hypothesis that the insider was researching and adapting publicly available offensive security tools for use inside the organization’s environment.

Stage: investigation
(how valid credentials were gained)

That raised the critical question: how did the insider obtain the credentials needed to execute the script on the server?

Audit trail data in DTEX Platform showed no evidence of remote access to the server by the insider. With no DTEX Forwarder on the server, there was no direct visibility into activity around the script’s creation. The one known detail was that the script had been deployed within the week leading up to termination.

Investigators returned to the insider’s tagged activity across that window, and the retrospective review opened a new line of inquiry into how access was obtained.

Stage: reconnaissance
(SharePoint searching)

A concentrated burst of SharePoint search activity was observed inside a three to four hour window, focused on file structures within the engineering and cybersecurity departments.

Role-Based Access Control (RBAC) prevented the user from opening file contents, but their permissions allowed visibility into file names and directory structures. The pattern points to reconnaissance aimed at identifying sensitive resources and gathering context for later action.

Stage: Reconnaissance
(Slack social engineering)

Following the SharePoint reconnaissance, the insider initiated contact with several employees over Slack.

Interviews with those employees revealed the lapse. A junior member of the cybersecurity team had allowed the insider to view a highly confidential penetration test report. The annexes included the domain password, which had not been reset after the test concluded. That disclosure handed the insider the credentials used for the malicious activity that followed.

Post-investigation review

The incident produced several learning opportunities that have since driven operational change.

Operational security policies were developed for each team, with Request for Information (RFI) guidelines built on need-to-know. The guidelines help employees, particularly junior staff, recognize when and how to handle requests for sensitive information. Applied here, that framework would have given the junior cybersecurity analyst grounds to refuse the request or escalate it.

The investigation also surfaced a run of poor operational practice behind the failure to reset the domain password after the penetration test, including inadequate project scheduling, weak information handling protocols, and risk registers that were never updated. Together those gaps created the opening the insider exploited.

Stage: review
(round table discussion)

The speed of it was the concerning part. The insider formed a plan, used generative AI to help develop a malicious script, and social engineered credentials in a short span. Technical proficiency, AI tooling, and social engineering converged fast enough to create real risk before anyone recognized what was happening.

In response, i³ analysts and the investigations team met to work through strategies for earlier detection of disgruntled employees in comparable roles, looking for behavioral indicators, access anomalies, and communication patterns that could serve as early warning and allow intervention before malicious action.

Stage: potential risk indicators
(flight risk and start of disgruntlement)

One month before the incident, the insider was passed over for a promotion. Behavioral indicators consistent with flight risk were observed at the time and raised appropriately with the organization. Because the timing lined up with the promotion decision, they were read as a natural emotional response and set aside.

Retrospective review showed the insider had begun searching for new employment the day before the promotion announcement. Either they anticipated the outcome or had already disengaged, and the window for earlier intervention was missed.

Analyst note: the timing may be coincidental, or it may suggest the insider had advance knowledge of being passed over and started seeking alternative employment proactively. That theory aligns with other assumptions, including the possibility that the insider knew about the upcoming layoffs before they were announced.

At the time of this Insider Threat Assessment (iTA) there is no direct evidence to confirm either scenario. Both remain plausible and unverified.

Stage: potential risk indicators
(manual sentiment analysis)

Technical performance held steady between the promotion decision and termination, but a review of weekly manager notes showed a clear rise in signs of disgruntlement across that period.

The organization now recognizes the value of those qualitative signals and is looking at ways to review and track sentiment in manager notes systematically. The current project plan is an HR integration that adds users to a “disgruntled” group, which then fires a trigger rule to alert on related activity or behavior.

Insider threat profile

DTEX delivers data and investigations in a format built to be consumed quickly by our customers. Below is a high-level summary of the incident profile and the overlapping persona involved. For detailed insight, refer to the corresponding sections in our internal knowledge base.

Some parts of this Threat Advisory are classified as “limited distribution” and are accessible only to approved insider risk practitioners. To view the redacted information, please log in to the customer portal or contact the contact the i³ team.

Insider threat persona

Rogue software engineer profile summary

This investigation maps two distinct personas across different phases of behavior. From the first signs of flight risk through to the week before termination, the individual aligned with the Disgruntled Employee persona. Once they began researching methods to bypass security controls in the lead-up to termination, they moved into the Malicious Insider persona.

The personas exist to help organizations conceptualize and differentiate threat-hunting strategies. Separating the behavioral patterns lets teams detect and respond proactively without needing to replicate the exact scenario through technical emulation.

In the Disgruntled Employee phase, the motivation is clear, while the risk remains broad because it rests on the individual’s position and access rather than any single observed action.

Mitigations: what organizations should do now

DTEX Platform detection multipliers

Organizations can improve detection visibility and monitoring in their environments using the following approaches in DTEX Platform.

High risk account — persons of interest. Based on the post-investigation review, users identified with disgruntled traits can be added to the Persons of Interest named list and monitored using this indicator.

Integrations and data feeds. These are essential for insider risk practitioners because they add context to activity as it unfolds. File classification support helps by bringing established classifications into the dataset without adding operational burden.

HTTP inspection filtering. Enabling the full range of rules gives a far more definitive view of user behavior and provides the context needed to monitor and analyze AI usage across the organization. It was pivotal in this investigation, helping investigators narrow their focus to the servers worth examining.

Generative AI conversation monitoring

Being able to review the insider’s conversation history was the turning point in this investigation. With no direct cyber indicators tying the individual to server activity, those conversations supplied the context and behavioral evidence that moved the case forward.

That insight let investigators escalate the incident’s priority and shift attention toward the organization’s crown jewels, its most sensitive and high-value assets. Using conversational data as a behavioral signal points to how much cross-domain visibility now matters in insider threat investigations.

AI use policy and enforcement

Like this organization, we see more clear AI usage policies paired with employee training aimed at reducing AI-related risk. Those efforts sit closely alongside the recommendations in the i³ Threat Advisory: AI Note-Taking Tools for Data Exfiltration.

The next step is moving past policy and education into enforcement. That can mean active allowlisting of approved AI tools, or a structured “teachable moments” program that reinforces responsible AI use through real-time feedback and guidance. Both are informed and supported by the Generative AI Utilization Dashboard, which gives visibility into usage patterns, tool diversity, and potential policy violations, enabling data-driven enforcement and continuous improvement.

Monitoring and detection on crown jewels

Cybersecurity carries the adage that it is not a matter of if but when, a reminder that compromise is inevitable. That thinking should extend to insider risk, both because employees can introduce risk inadvertently or maliciously, and because any external threat actor who gains valid credentials effectively becomes an insider. Mohan Koo’s session on Blurred Lines made this point directly.

Organizations therefore need behavioral monitoring on their most critical assets, their servers. These systems hold the crown jewels and draw increasing attention from sophisticated adversaries, a point reinforced by the 2025 Verizon Data Breach Investigations Report.

Behavioral analytics at the server level is a significant advance in detection capability, particularly against nation-state actors, and aligns with the recommendations in the i³ Threat Advisory: Insider Risk Detection Strategies for Evolving Nation-State Cyber Espionage Campaigns.

Integration of additional data feeds and teams

Insider risk management does not belong to one team. Our i³ investigators work across departments constantly, tailoring the approach to the context of each case, and information is handed between teams in ways that demand coordination and mutual understanding.

In line with current best practice, organizations should stand up multidisciplinary insider risk teams drawing on cybersecurity, HR, legal, compliance, and IT. Those representatives contribute insight and ask the questions that surface hidden threats, which strengthens both the depth and the agility of insider threat detection and response.

Investigation support

This advisory includes limited-distribution reporting available only to approved insider risk practitioners. To request access to the redacted material, log in to the customer portal or contact DTEX i³. For organizations assessing suspected related activity, DTEX i³ can provide additional intelligence, indicator support, and investigative guidance. Behavioral detections should be tested and tuned prior to enterprise-wide deployment, particularly in large environments where scale can affect signal quality and operational effectiveness.