Início / Ransomware Intelligence / Todos os grupos / nightspire

nightspire Ransomware

🔔 Criar alerta

Monitorado desde 12/03/2025

1

vítimas registradas

1

nos últimos 30 dias

1

CVEs

1 d

Última atividade

NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

CVE-2024-55591 Crítica · 9.8 KEV Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Táticas e técnicas (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1110 Brute Force T1190 Exploit Public-Facing Application T1566 Phishing

Execution

T1059 Command and Scripting Interpreter T1072 Software Deployment Tools

Persistence

T1053 Scheduled Task/Job T1136 Create Account T1547 Boot or Logon Autostart Execution T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1027 Obfuscated Files or Information T1036 Masquerading T1070 Indicator Removal T1218 System Binary Proxy Execution

Credential Access

T1003 OS Credential Dumping T1003.001 OS Credential Dumping: LSASS Memory T1552 Unsecured Credentials

Discovery

T1046 Network Service Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1047 Windows Management Instrumentation

Collection

T1119 Automated Collection T1560 Archive Collected Data T1560.001 Archive Collected Data: Archive via Utility

Exfiltration

T1041 Exfiltration Over C2 Channel T1048 Exfiltration Over Alternative Protocol T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Command and Control

T1071 Application Layer Protocol T1573 Encrypted Channel

Impact

T1486 Data Encrypted for Impact

Resource Development

T1587 Develop Capabilities

Ferramentas observadas

Discovery Enum

Everything.exe

Exfiltration

MEGA · WinSCP

Países mais afetados (30 dias)

Setores mais afetados (30 dias)

Technology1

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live