blacksuit Ransomware
Monitorado desde 12/06/2023
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1021.001 Remote Services: Remote Desktop ProtocolT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1566 PhishingT1566.001 Phishing: Spear phishing AttachmentT1566.002 Phishing: Spear phishing Link Privilege Escalation
T1078 Valid AccountsT1078.002 Valid Accounts: Domain Accounts Defense Evasion
T1021.001 Remote Services: Remote Desktop ProtocolT1070.001 Indicator Removal: Clear Windows Event LogsT1119 Automated CollectionT1484.001 Domain Policy Modification: Group Policy ModificationT1562.001 Impair Defenses: Disable or Modify Tools Command and Control
T1105 Ingress Tool TransferT1572 Protocol Tunneling Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Resource Development
T1650 Acquire Access Ferramentas observadas
Credential Theft
AccountRestore · Mimikatz · NirSoft Dialupass · NirSoft IEPassView (iepv) · NirSoft MailPassView · NirSoft Netpass · NirSoft RouterPassView
Defense Evasion
Eraser · GMER · Inno Setup · PowerTool · VirtualBox
Discovery Enum
AdFind · Advanced IP Scanner · SharpHound · SharpShares · SoftPerfect NetScan
Exfiltration
7-Zip · Bublup · RClone · Temp[.]sh
LOLBAS
NTDS Utility (ntdsutil) · PowerShell · PsExec · WMIC · attrib
Networking
Chisel · Cloudflared · OpenSSH
Offsec
Brute Ratel C4 · Cobalt Strike · Rubeus
RMM-Tools
AnyDesk · Atera · LogMeIn · MobaXterm
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live