.svg)
.svg)
By Huseyin Can YUCEEL & Picus Labs August 22, 2022 Ransomware
|
Associated Groups |
Aliases - ALPHV, Noberus Successor - BlackMatter and REvil |
|
Associated Country |
Russia |
|
First Seen |
November 2021 |
|
Target Sectors |
Aviation, Construction, Education, Energy, Entertainment, Fashion, Financial Services, Government, Hospitality, Information Technology, Transportation |
|
Target Countries |
United States, Australia, Canada, China, France, Germany, India, Italy, Japan, Romania, Spain, Taiwan, United Kingdom |
|
Business Models |
Ransomware-as-a-service (RaaS) Triple Extortion Initial Access Brokers (IABs) |
|
Extortion Tactics |
File Encryption |
|
Initial Access Methods |
Exploit Public-Facing Application External Remote Services Valid Account |
|
Impact Methods |
Data Encryption Data Exfiltration |
|
Application |
Vulnerability |
CVE |
CVSS |
|
Fortinet FortiGate |
Path Traversal |
9.8 Critical |
|
MITRE ATT&CK Tactic |
Tools |
|
Execution
|
Cobalt Strike PowerShell Windows Task Scheduler |
|
Persistence |
Windows Task Scheduler |
|
Credential Access |
LaZagne Mimikatz |
|
Lateral Movement |
PSExec |
|
Command and Control |
Cobalt Strike Koadic |
|
Exflitration |
ExMatter (Fendr) malware |
|
Impact |
BlackCat Locker malware Vssadmin |
-
[1] K. Arhart, “Cobalt Strike,” Cobalt Strike Research and Development, Aug. 19, 2021. https://www.cobaltstrike.com/ (accessed Jul. 06, 2022).
-
[2] S. Özarslan, “MITRE ATT&CK T1086 PowerShell.” https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1086-powershell (accessed Jul. 06, 2022).
-
[3] “GitHub - EmpireProject/Empire: Empire is a PowerShell and Python post-exploitation agent,” GitHub. https://github.com/EmpireProject/Empire (accessed Jul. 06, 2022).
-
[4] “PsExec - Windows Sysinternals.” https://docs.microsoft.com/en-us/sysinternals/downloads/psexec (accessed Jul. 06, 2022).
-
[5] S. Özarslan, “MITRE ATT&CK T1053 Scheduled Task.” https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-1053-scheduled-task (accessed Jul. 06, 2022).
-
[6] “GitHub - AlessandroZ/LaZagne: Credentials recovery project,” GitHub. https://github.com/AlessandroZ/LaZagne (accessed Jul. 06, 2022).
-
[7] “GitHub - gentilkiwi/mimikatz: A little tool to play with Windows security,” GitHub. https://github.com/gentilkiwi/mimikatz (accessed Jul. 06, 2022).
-
[8] “zerosum0x0-archive/archive,” GitHub. https://github.com/zerosum0x0-archive/archive (accessed Jul. 06, 2022).
-
[9] F. Fkie, “ExMatter (Malware Family).” https://malpedia.caad.fkie.fraunhofer.de/details/win.exmatter (accessed Jul. 06, 2022).
-
[10] F. Fkie, “BlackCat (Malware Family).” [Online]. Available: https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat. [Accessed: Aug. 03, 2022]
-
[11] H. C. Yüceel, “MITRE ATT&CK T1490 Inhibit System Recovery - The Ransomware’s Favorite.” https://www.picussecurity.com/resource/mitre-attck-t1490-inhibit-system-recovery-the-ransomwares-favorite (accessed Jul. 06, 2022).
Share this article:
