.svg)
.svg)
By Huseyin Can YUCEEL & Picus Labs August 22, 2022 Ransomware
|
Associated Groups |
- |
|
Associated Country |
Russia |
|
First Seen |
April 2022 |
|
Target Sectors |
Automotive, Construction, Cosmetics, Energy, Healthcare, Heating, Manufacturing, Pharmaceuticals, Plumbing, Telecommunication, Transportation, Textile |
|
Target Countries |
United States, Australia, Canada, India, New Zealand, Singapore, United Arab Emirates, United Kingdom |
|
Business Models |
Ransomware-as-a-service (RaaS) Double Extortion |
|
Extortion Tactics |
File Encryption Data Leakage |
|
Initial Access Methods |
Exploit Public-Facing Application Phishing External Remote Services |
|
Impact Methods |
Data Encryption Data Exfiltration |
|
Application |
Vulnerability |
CVE |
CVSS |
|
Windows Print Spooler |
Remote Code Execution |
8.8 High |
|
|
MITRE ATT&CK Tactic |
Tools |
|
Initial Access |
QakBot |
|
Execution |
Cobalt Strike |
|
Persistence |
Cobeacon Backdoor |
|
Privilege Execution |
Mimikatz |
|
Defence Evasion |
Coroxy |
|
Discovery |
Cobalt Strike |
|
Lateral Movement |
netcat |
|
Exflitration |
Mega Google Drive |
|
Impact |
vssadmin Black Basta Ransomware |
-
[1] F. Fkie, “QakBot (Malware Family).” [Online]. Available: https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot. [Accessed : Jul. 07, 2022]
-
[2] K. Arhart, “Cobalt Strike,” Cobalt Strike Research and Development, Aug. 19, 2021. https://www.cobaltstrike.com/ (accessed Jul. 06, 2022).
-
[3] “Backdoor.Win32.COBEACON.A.” [Online]. Available: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.cobeacon.a. [Accessed: Jul. 07, 2022]
-
[4] “GitHub - gentilkiwi/mimikatz: A little tool to play with Windows security,” GitHub. https://github.com/gentilkiwi/mimikatz (accessed Jul. 06, 2022).
-
[5] “Trojan.Win32.COROXY.A.” [Online]. Available: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.coroxy.a/. [Accessed: Jul. 07, 2022]
-
[6] H. C. Yüceel, “MITRE ATT&CK T1490 Inhibit System Recovery - The Ransomware’s Favorite.” https://www.picussecurity.com/resource/mitre-attck-t1490-inhibit-system-recovery-the-ransomwares-favorite (accessed Jul. 06, 2022).
-
[7] G. Giacobbi, “The GNU Netcat -- Official homepage.” [Online]. Available: http://netcat.sourceforge.net. [Accessed: Jul. 07, 2022]
-
[8] S. Özarslan, “MITRE ATT&CK T1003 Credential Dumping.” https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1003-credential-dumping (accessed Jul. 05, 2022).
-
[9] F. Fkie, “Black Basta (Malware Family).” [Online]. Available: https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta. [Accessed: Jul. 07, 2022]
Share this article:
