Emulating the Extortionist Mallox Ransomware
AttackIQ has released a new attack graph that emulates the behaviors exhibited by Mallox ransomware since the beginning of its activities in June 2021. Mallox primarily gains access to victim networks through dictionary brute-force attacks against unsecured MS-SQL servers. The post Emulating the Extortionist Mallox Ransomware appeared first on AttackIQ ... Read More
Emulating Sandworm’s Prestige Ransomware
AttackIQ has released a new attack graph that emulates the behaviors exhibited by Prestige ransomware since the beginning of its activities in October 2022. Prestige has been observed targeting organizations in the transportation and related logistics sectors located in Ukraine and Poland. In November 2022, it was assessed that the ... Read More
Emulating the Politically Motivated North Korean Adversary Andariel – Part 2
AttackIQ has released a new attack graph that emulates the behaviors exhibited by the North Korean state-sponsored adversary Andariel during Operation Blacksmith which affected manufacturing, agricultural and physical security companies in multiple regions. The post Emulating the Politically Motivated North Korean Adversary Andariel – Part 2 appeared first on AttackIQ ... Read More
Response to CISA Advisory (AA24-207A): North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs
AttackIQ has released a new assessment template in response to the CISA Advisory (AA24-207A) published on July 25, 2024, that highlights cyber espionage activity associated with the Democratic People’s Republic of Korea (DPRK)’s Reconnaissance General Bureau (RGB) 3rd Bureau based in Pyongyang and Sinuiju. The post Response to CISA Advisory ... Read More
Emulating the Prickly Cactus Ransomware
AttackIQ has released a new attack graph that emulates the behaviors exhibited by the Cactus ransomware since the beginning of its activities in March 2023. Cactus has targeted a wide variety of organizations since its inception and has breached more than 100 entities as of April 2024. The post Emulating ... Read More
Emulating the Long-Term Extortionist Nefilim Ransomware
AttackIQ has released a new attack graph that emulates the behaviors exhibited by the extortionist ransomware Nefilim during activities against multiple organizations, primarily based in North or South America, distributed in the financial, manufacturing, or transportation industries since its emergence in March 2020. The post Emulating the Long-Term Extortionist Nefilim ... Read More
Emulating the Sabotage-Focused Russian Adversary Sandworm– Part 2
AttackIQ has released two new attack graphs that emulate the behaviors exhibited by the highly sophisticated Russian adversary Sandworm during various destructive activities against targets in Ukraine and other countries in the region shortly before the launch of the Russian invasion on February 24, 2022. The post Emulating the Sabotage-Focused ... Read More
Response to CISA Advisory (AA24-060A): #StopRansomware: Phobos Ransomware
AttackIQ has released a new attack graph in response to the CISA Advisory (AA24-060A) published on February 29, 2024, which disseminates known Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) associated with the Phobos Ransomware variants observed as recently as February 2024. The post Response to CISA Advisory ... Read More
Response to CISA Advisory (AA24-131A): #StopRansomware: Black Basta
AttackIQ has released a new attack graph in response to the recently published CISA Advisory (AA24-131A) which disseminates known Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) associated to Black Basta ransomware, a ransomware variant whose operators have encrypted and stolen data from at least 12 out of ... Read More
Response to CISA Advisory (AA24-109A): #StopRansomware: Akira Ransomware
AttackIQ has released a new attack graph in response to the recently published CISA Advisory (AA24-109A) which disseminates known Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) associated to Akira ransomware, identified through FBI investigations and trusted third party reporting as recently as February 2024. The post Response ... Read More
