Início / Ransomware Intelligence / Todos os grupos / 0apt

0apt Ransomware

Monitorado desde 28/01/2026

vítimas registradas

nos últimos 30 dias

CVEs

—

Última atividade

The group appears unreliable. Most, if not all, of its alleged victims cannot be verified and appear to be randomly selected organizations. WE HAVE DECIDED TO REMOVE ENTRIES FOR THIS GROUP

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

Nenhuma CVE associada a este grupo nas fontes.

Táticas e técnicas (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1133 External Remote Services T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

Execution

T1047 Windows Management Instrumentation T1059.001 Command and Scripting Interpreter: PowerShell T1204.002 User Execution: Malicious File

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task T1547.001 Boot or Logon Autostart Execution: Registry Run Keys

Defense Evasion

T1014 Rootkit T1027 Obfuscated Files or Information T1036 Masquerading T1055 Process Injection T1070 Indicator Removal T1140 Deobfuscate/Decode Files or Information T1562.001 Impair Defenses: Disable or Modify Tools T1564 Hidden Artifacts T1622 Debugger Evasion T1672 Email Spoofing T1678 Delay Execution

Credential Access

T1003 OS Credential Dumping T1003.001 OS Credential Dumping: LSASS Memory T1555 Credentials from Password Stores

Discovery

T1082 System Information Discovery T1083 File and Directory Discovery T1135 Network Share Discovery T1526 Cloud Service Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1570 Lateral Tool Transfer

Collection

T1005 Data from Local System T1039 Data from Network Shared Drive T1056 Input Capture T1119 Automated Collection T1560 Archive Collected Data

Exfiltration

T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service

Command and Control

T1071.001 Application Layer Protocol: Web Protocols T1573 Encrypted Channel

Impact

T1485 Data Destruction T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live