underground Ransomware

Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

• CVE-2023-36884 Alta · 7.5 KEV Microsoft Windows Search Remote Code Execution Vulnerability