Okay, deep breath, let's get this over with. In the grand act of digital self-sabotage, we've littered this site with cookies. Yep, we did that. Why? So your highness can have a 'premium' experience or whatever. These traitorous cookies hide in your browser, eagerly waiting to welcome you back like a guilty dog that's just chewed your favorite shoe. And, if that's not enough, they also tattle on which parts of our sad little corner of the web you obsess over. Feels dirty, doesn't it?
Ransomware Hide and Seek: Top Tools and Tactics Exposed!
In December 2023, we stumbled upon an open directory filled with defense evasion scripts targeting antivirus and critical services. Threat actors used tools like Ngrok for proxy services and PoshC2 for command and control. The infrastructure has been active since September 2023, pointing to long-term…
Hot Take:
If hackers spent half as much time creating defenses as they do evading them, we’d have a cybersecurity utopia. But alas, they’d rather play hide and seek with our data like it’s their favorite childhood game!
Key Points:
- Discovered open directory with scripts for disabling antivirus and stopping critical services.
- Scripts for deleting backups and logs, and installing/removing remote monitoring tools.
- Use of proxy tools like Ngrok and command and control frameworks like Sliver and PoshC2.
- Long-term usage by threat actors, active from September 2023 to August 2024.
- Ten new sigma rules have been created from this investigation.
Already a member? Log in here