karma Ransomware
Monitorado desde 04/10/2021
0
vítimas registradas
0
nos últimos 30 dias
1
CVEs
—
Última atividade
No MITRE ATT&CK MITRE ATT&CK
Perfil do grupo: VOID MANTICORE (G1055)
Karma is a ransomware group first observed in mid-2021, part of a lineage tracing back through Nefilim and FiveHands, operating double-extortion attacks against enterprises in healthcare, manufacturing, and technology; the group was managed by threat actor "farnetwork" who ran multiple RaaS programs across related strains.
Platforms: Windows and Linux
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
- CVE-2019-0604 Crítica · 9.8 KEV Microsoft SharePoint Remote Code Execution Vulnerability
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1078.002 Valid Accounts: Domain AccountsT1078.004 Valid Accounts: Cloud AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1566 Phishing Execution
T1047 Windows Management InstrumentationT1059.001 Command and Scripting Interpreter: PowerShellT1059.006 Command and Scripting Interpreter: PythonT1072 Software Deployment ToolsT1204.002 User Execution: Malicious FileT1651 Cloud Administration Command Persistence
T1078 Valid AccountsT1078.002 Valid Accounts: Domain AccountsT1078.004 Valid Accounts: Cloud AccountsT1098 Account ManipulationT1133 External Remote ServicesT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Privilege Escalation
T1078 Valid AccountsT1078.002 Valid Accounts: Domain AccountsT1078.004 Valid Accounts: Cloud AccountsT1098 Account ManipulationT1484.001 Domain or Tenant Policy Modification: Group Policy ModificationT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Stealth
T1027.015 Obfuscated Files or Information: CompressionT1036.004 Masquerading: Masquerade Task or ServiceT1036.005 Masquerading: Match Legitimate Resource Name or LocationT1078 Valid AccountsT1078.002 Valid Accounts: Domain AccountsT1078.004 Valid Accounts: Cloud AccountsT1564.003 Hide Artifacts: Hidden WindowT1679 Selective ExclusionT1684.001 Social Engineering: Impersonation Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1110 Brute ForceT1110.001 Brute Force: Password GuessingT1110.004 Brute Force: Credential StuffingT1552.002 Unsecured Credentials: Credentials in Registry Discovery
T1082 System Information DiscoveryT1087.002 Account Discovery: Domain Account Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1072 Software Deployment Tools Collection
T1005 Data from Local SystemT1074 Data StagedT1113 Screen CaptureT1114.002 Email Collection: Remote Email CollectionT1119 Automated CollectionT1123 Audio CaptureT1125 Video CaptureT1213.002 Data from Information Repositories: SharepointT1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1041 Exfiltration Over C2 Channel Command and Control
T1071.001 Application Layer Protocol: Web ProtocolsT1102 Web ServiceT1105 Ingress Tool TransferT1219.002 Remote Access Tools: Remote Desktop SoftwareT1572 Protocol Tunneling Impact
T1485 Data DestructionT1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1561.001 Disk Wipe: Disk Content WipeT1561.002 Disk Wipe: Disk Structure WipeT1657 Financial Theft Resource Development
T1583.001 Acquire Infrastructure: DomainsT1583.003 Acquire Infrastructure: Virtual Private ServerT1583.004 Acquire Infrastructure: ServerT1583.006 Acquire Infrastructure: Web ServicesT1585.001 Establish Accounts: Social Media AccountsT1585.002 Establish Accounts: Email AccountsT1587.001 Develop Capabilities: MalwareT1588.001 Obtain Capabilities: MalwareT1588.002 Obtain Capabilities: Tool Reconnaissance
T1589 Gather Victim Identity InformationT1595.002 Active Scanning: Vulnerability Scanning Defense Impairment
T1484.001 Domain or Tenant Policy Modification: Group Policy ModificationT1686.003 Disable or Modify System Firewall: Windows Host Firewall Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live