DEV-0537 criminal actor targeting organizations for data exfiltration and destruction - Microsoft Security Blog
Tags
country: United Kingdom
attack-pattern: Data Model Business Relationships - T1591.002 Code Repositories - T1213.003 Code Repositories - T1593.003 Conditional Access Policies - T1556.009 Confluence - T1213.001 Credentials - T1589.001 Dcsync - T1003.006 Device Registration - T1098.005 Domains - T1583.001 Domains - T1584.001 Email Accounts - T1585.002 Email Accounts - T1586.002 Email Addresses - T1589.002 Impersonation - T1656 Ip Addresses - T1590.005 Malware - T1587.001 Malware - T1588.001 Remote Desktop Protocol - T1021.001 Sharepoint - T1213.002 Social Media - T1593.001 Software - T1592.002 Virtual Private Server - T1583.003 Virtual Private Server - T1584.003 Tool - T1588.002 Vulnerabilities - T1588.006 Remote Desktop Protocol - T1076
Show in Graph
Common Information
Type Value
UUID e1849cb8-82f1-4b6e-bbc6-91d9717e5983
Fingerprint 2d11b3921a91c645
Analysis status DONE
Considered CTI value 1
Text language
Published March 22, 2022, 3:02 p.m.
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Sept. 4, 2024, 12:46 p.m.
Headline DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
Title DEV-0537 criminal actor targeting organizations for data exfiltration and destruction - Microsoft Security Blog
Detected Hints/Tags/Attributes 115/2/1
Source URLs
Redirection Url
Details Source https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
URL Provider
Details Provider Source level domain
Details microsoft.com www.microsoft.com
Attributes
Details Type #Events CTI Value
Details Deprecated Microsoft Threat Actor Naming Taxonomy (Groups in development) 20 
DEV-0537