Inactive ransomware operator
← All groupsBlackshadow
3 victims indexed · first seen 4 years ago · last activity 4 years ago
At a glance
- Status
- inactive
- First seen
- 4 years ago
- Last activity
- 4 years ago
- Onion sites
- 1 known endpoint
- Primary sector
- Finance · 2 hits
About
References
3 linksExternal sources curated by the MISP threat-intel community.
Timeline
1 monthsTop sectors
MITRE ATT&CK
22 techniques · 12 tacticsTactics
Techniques
- T1003.001LSASS Memory
- T1003.002Security Account Manager
- T1005Data from Local System
- T1018Remote System Discovery
- T1021.001Remote Desktop Protocol
- T1036Masquerading
- T1041Exfiltration Over C2 Channel
- T1046Network Service Discovery
- T1059.003Windows Command Shell
- T1074.001Local Data Staging
- T1078.002Domain Accounts
- T1110Brute Force
- T1110.003Password Spraying
- T1119Automated Collection
- T1140Deobfuscate/Decode Files or Information
- T1190Exploit Public-Facing Application
- T1505.003Web Shell
- T1543.003Windows Service
- T1560.001Archive via Utility
- T1570Lateral Tool Transfer
- T1583Acquire Infrastructure
- T1685Disable or Modify Tools
Recent victims
Loading…
Onion infrastructure
1 known- http://544corkfh5hwhtn4.onion
Source
Updated 4 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
