When Security Assessments Become Forensics: Hunting APT Activity in Enterprise Gateways

This incident response case study reveals how routine security assessments can uncover sophisticated APT operations embedded in custom enterprise infrastructure. The investigation demonstrates critical methodologies for detecting malicious activity within encrypted HTTPS traffic and highlights vulnerabilities in specialized Linux-based gateway systems running Go applications, offering practical insights into protecting PII and maintaining GDPR compliance.