Payment Gateway Timeline with Time Drift and Cleared Logs

Build the timeline from multiple independent sources rather than relying on the server with the log gap. Anchor the VPN authentication, RDP session, local administrator creation, and firewall egress using VPN, jump-host, domain-controller, EDR, and firewall records. Apply the 7-minute correction to timestamps from the drifted server and state the uncertainty; order events relatively where absolute times conflict. The Event ID 1102 at 04:05 is an anti-forensic indicator, not proof that nothing happened before it; the 2-hour gap may hide activity, so the PFI should seek copies in the SIEM, backups, EDR, or remote log collectors. The syslog-without-TLS weakness means log integrity is not assured, so corroboration is essential. A defensible conclusion might be that svc_batch was used from an unfamiliar network, RDP occurred, an administrator account was created, and 1.2 GB left the environment, but the exact actions during the gap remain unknown. The report must distinguish confirmed events from inferred ones and avoid presenting a precise timeline where evidence is missing.

Containment should preserve evidence before rebuilding. Isolate the application server and jump host at the network level without immediately wiping them, capture memory and disk images, and preserve VPN, firewall, EDR, and authentication logs. Block the cloud storage IP and associated indicators at egress, but monitor for alternate destinations. Disable svc_batch and any accounts created by the attacker, revoke VPN certificates and sessions, and rotate credentials for all accounts that could have been exposed, including service accounts and local administrators. If domain compromise is plausible, plan a Kerberos key reset in the correct sequence. Rebuild only after evidence collection is complete and the scope of persistence is understood. The IR team should not rotate every credential blindly before preserving authentication logs; rotation can destroy or overwrite useful artifacts. After containment, hunt for the same service account use, RDP patterns, and new local administrators across the environment. The order is preserve, isolate, evict, rotate, rebuild, and monitor.

The token age and log retention limit the ability to prove which tokens were exposed. Tokens issued 4–7 months ago may have been accessible during the intrusion even if the logs no longer show the access. The PFI should examine the tokenization system itself: whether tokens are stored with PAN mapping, whether the attacker reached the token vault or key material, and whether the 1.2 GB exfiltration could include token data. Ninety days of logs may not cover the initial access or earlier reconnaissance; the report should state the retention gap and avoid claiming the first observed VPN login was the first compromise. Reporting should include confirmed unauthorized access, confirmed data egress, and potential token exposure, with the basis for each. The gateway should notify affected merchant and card brands as required, preserve what remains, and extend retention. Scope should include the VPN, jump host, application server, tokenization infrastructure, and any system reachable with the compromised credentials.