TWELVE Threat Attacks Windows To Encrypt Then Deleting Victims’ Data
Tags
country: Russia
attack-pattern: Data Credentials - T1589.001 Data Destruction - T1662 Data Destruction - T1485 Domain Accounts - T1078.002 Impersonation - T1656 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Ssh - T1021.004 Web Shell - T1505.003 Tool - T1588.002 Vulnerabilities - T1588.006 Powershell - T1086 Web Shell - T1100 Data Destruction
Show in Graph
Common Information
Type Value
UUID 19941f55-8bf5-48e5-b640-6f583e95ef8b
Fingerprint 8580add38ab39d85
Analysis status DONE
Considered CTI value 0
Text language
Published Sept. 26, 2024, 8:48 a.m.
Added to db Sept. 26, 2024, 11:22 a.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline UNKNOWN
Title TWELVE Threat Attacks Windows To Encrypt Then Deleting Victims’ Data
Detected Hints/Tags/Attributes 50/2/6
Source URLs
Redirection Url
Details Source https://gbhackers.com/twelve-windows-encrypt-delete/
URL Provider
Details Provider Source level domain
Details gbhackers.com gbhackers.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 125 ✔ GBHackers Security | #1 Globally Trusted Cyber Security News Platform https://gbhackers.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 52 
cve-2021-21972
Details CVE 26 
cve-2021-22005
Details Domain 911 
any.run
Details File 256 
net.exe
Details File 165 
reg.exe
Details File 59 
ntdsutil.exe