blackshadow Ransomware
Monitorado desde 18/12/2021
0
vítimas registradas
0
nos últimos 30 dias
1
CVEs
—
Última atividade
No MITRE ATT&CK MITRE ATT&CK
Perfil do grupo: Agrius (G1030)
BlackShadow is an Iranian-linked hack-and-leak group (linked to the Agrius APT) that targeted Israeli companies including insurance firm Shirbit and hosting provider Cyberserve, leaking medical records of 290,000 patients, using extortion as a tool of geopolitical disruption rather than purely for financial gain.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
- CVE-2018-13379 Crítica · 9.8 KEV Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078.002 Valid Accounts: Domain AccountsT1190 Exploit Public-Facing Application Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell Persistence
T1078.002 Valid Accounts: Domain AccountsT1505.003 Server Software Component: Web ShellT1543.003 Create or Modify System Process: Windows Service Privilege Escalation
T1078.002 Valid Accounts: Domain AccountsT1543.003 Create or Modify System Process: Windows Service Stealth
T1036 MasqueradingT1078.002 Valid Accounts: Domain AccountsT1140 Deobfuscate/Decode Files or Information Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1003.002 OS Credential Dumping: Security Account ManagerT1110 Brute ForceT1110.003 Brute Force: Password Spraying Discovery
T1018 Remote System DiscoveryT1046 Network Service Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1570 Lateral Tool Transfer Collection
T1005 Data from Local SystemT1074.001 Data Staged: Local Data StagingT1119 Automated CollectionT1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1041 Exfiltration Over C2 Channel Resource Development
T1583 Acquire Infrastructure Defense Impairment
T1685 Disable or Modify Tools Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live