vicesociety Ransomware
Monitorado desde 31/05/2021
0
vítimas registradas
0
nos últimos 30 dias
2
CVEs
—
Última atividade
Vice Society ransomware appends the .v-society extension when encrypting Linux machines. Running a leak site on the darkweb, Possible relations with "HelloKitty"
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
- CVE-2021-34527 Alta · 8.8 KEV Microsoft Windows Print Spooler Remote Code Execution Vulnerability
- CVE-2021-1675 Alta · 7.8 KEV Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing Application Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command Shell Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1070.001 Indicator Removal: Clear Windows Event LogsT1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1003.003 OS Credential Dumping: NTDS Discovery
T1046 Network Service Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1219 Remote Access Software Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Ferramentas observadas
Discovery Enum
Advanced IP Scanner · Advanced Port Scanner
Exfiltration
MEGA · RClone · WinSCP
LOLBAS
Minidump · NTDS Utility (ntdsutil) · PsExec · WMIC
Networking
Proxychains
Offsec
Cobalt Strike · Impacket · PowerShell Empire · PowerSploit
RMM-Tools
PowerAdmin
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live