Início / Ransomware Intelligence / Todos os grupos / donex

donex Ransomware

🔔 Criar alerta

Monitorado desde 08/03/2024

0

vítimas registradas

0

nos últimos 30 dias

0

CVEs

—

Última atividade

DoNex is a ransomware strain that emerged in March 2024 as the latest rebrand of a lineage beginning with Muse (2022) → DarkRace (2023) → DoNex, targeting enterprises in the US and Europe using double-extortion; Avast released a free decryptor in July 2024 after discovering a cryptographic flaw.

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

Nenhuma CVE associada a este grupo nas fontes.

Táticas e técnicas (MITRE ATT&CK)

Execution

T1047 Windows Management Instrumentation T1059 Command and Scripting Interpreter T1064 Scripting T1106 Native API T1129 Shared Modules

Persistence

T1543.003 Windows Services

Defense Evasion

T1027 Obfuscated Files or Information T1027.005 Indicator Removal from Tools T1027.009 Embedded Payloads T1036 Masquerading T1064 Scripting T1070.001 Clear Windows Event Logs T1070.004 File Deletion T1202 Indirect Command Execution T1222 File and Directory Permissions Modification T1548 Abuse Elevation Control Mechanism T1562.001 Disable or Modify Tools T1564.003 Hidden Window

Credential Access

T1056 Input Capture

Discovery

T1007 System Service Discovery T1010 Application Window Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1135 Network Share Discovery T1518.001 Security Software Discovery

Collection

T1074 Data Staged T1119 Automated Collection

Impact

T1485 Data Destruction T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live