qilin Ransomware
Monitorado desde 08/10/2022
9
vítimas registradas
9
nos últimos 30 dias
0
CVEs
1 d
Última atividade
No MITRE ATT&CK MITRE ATT&CK
Ransomware catalogado como Qilin (S1242)
Usado por: Moonstone Sleet G1036Water Galura G1050
Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 PhishingT1566.003 Phishing: Spearphishing via Service Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.004 Command and Scripting Interpreter: Unix ShellT1569 System ServicesT1569.002 System Services: Service Execution Persistence
T1037 Boot or Logon Initialization ScriptsT1053 Scheduled Task/JobT1053.005 Scheduled Task/Job: Scheduled TaskT1098.004 Account Manipulation: SSH Authorized KeysT1136 Create AccountT1547 Boot or Logon Autostart Execution Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1027 Obfuscated Files or InformationT1036.001 Masquerading: Invalid Code SignatureT1134.004 Access Token Manipulation: Parent PID SpoofingT1211 Exploitation for Defense EvasionT1480 Execution GuardrailsT1497.001 Virtualization/Sandbox Evasion: System ChecksT1553.002 Subvert Trust Controls: Code SigningT1562.001 Disable or Modify ToolsT1562.004 Impair Defenses: Disable or Modify System FirewallT1564 Hidden ArtifactsT1564.003 Hidden Artifacts: Hidden Window Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1040 Network SniffingT1110.002 Brute Force: Password CrackingT1555.003 Credentials from Web Browsers Discovery
T1012 Query RegistryT1046 Network Service DiscoveryT1082 System Information DiscoveryT1614 System Location Discovery Lateral Movement
T1021 Remote ServicesT1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin SharesT1021.004 Remote Services: SSHT1570 Lateral Tool Transfer Collection
T1560.001 Archive Collected Data: Archive via UtilityT1602.002 Network Device Configuration Dump Exfiltration
T1011 Exfiltration Over Other Network MediumT1011.001 Exfiltration Over Other Network Medium: Exfiltration Over BluetoothT1048.003 Exfiltration Over Alternative Protocol: Unencrypted Non-C2 ProtocolT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1001 Data ObfuscationT1001.001 Data Obfuscation: Junk DataT1071.001 Application Layer Protocol: Web ProtocolsT1572 Protocol Tunneling Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1561 Disk WipeT1561.001 Disk Wipe: Disk Content Wipe Resource Development
T1587.001 Develop Capabilities: Malware Reconnaissance
T1590.004 Gather Victim Network Information: Network Topology Ferramentas observadas
Credential Theft
Mimikatz
Defense Evasion
EDRSandBlast · PCHunter · PowerTool · Toshiba power management driver (BYOVD) · Updater for Carbon Black’s Cloud Sensor AV (upd.exe) · YDArk · Zemana Anti-Rootkit driver
Discovery Enum
Nmap · Nping
Exfiltration
EasyUpload.io · MEGA
LOLBAS
PowerShell · PsExec · WinRM · fsutil
Networking
Proxychains
Offsec
Cobalt Strike · Evilginx · Kali Linux · NetExec · SystemBC · Tofsee
RMM-Tools
NetSupport · ScreenConnect
Países mais afetados (30 dias)
- Estados Unidos4
- Espanha1
- Equador1
- México1
- Singapura1
Setores mais afetados (30 dias)
- Professional Services4
- Energy & Utilities2
- Transportation1
- Financial Services1
- Education1
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live