Inactive ransomware operator
← All groupsCicada3301
75 victims indexed · first seen 2 years ago · last activity 9 months ago
At a glance
- Status
- inactive
- First seen
- 2 years ago
- Last activity
- 9 months ago
- Onion sites
- 1 known endpoint
- Primary sector
- Business Services · 20 hits
About
References
8 linksExternal sources curated by the MISP threat-intel community.
- ransomlook.io/group/cicada3301
- group-ib.com/blog/cicada3301/
- unit42.paloaltonetworks.com/repellent-scorpius-cicada3301-ransomware/
- thehackernews.com/2024/10/cross-platform-cicada3301-ransomware.html
- cyble.com/threat-actor-profiles/cicada3301/
- truesec.com/hub/blog/dissecting-the-cicada
- morphisec.com/blog/cicada3301-ransomware-threat-analysis
- waterisac.org/portal/ransomware-awareness-%E2%80%93-new-ransomware-group-%E2%80%9Ccicada3301%E2%80%9D-surfaces-connections-alphv-network
Timeline
12 monthsTop countries
Top sectors
MITRE ATT&CK
46 techniques · 12 tacticsTactics
Techniques
- T1003.002Security Account Manager
- T1003.003NTDS
- T1003.004LSA Secrets
- T1005Data from Local System
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021.001Remote Desktop Protocol
- T1021.004SSH
- T1027.013Encrypted/Encoded File
- T1036Masquerading
- T1036.003Rename Legitimate Utilities
- T1036.005Match Legitimate Resource Name or Location
- T1039Data from Network Shared Drive
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1053.005Scheduled Task
- T1055.012Process Hollowing
- T1056.001Keylogging
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1070.003Clear Command History
- T1070.004File Deletion
- T1074.001Local Data Staging
- T1074.002Remote Data Staging
- T1078Valid Accounts
- T1083File and Directory Discovery
- T1087.002Domain Account
- T1090.002External Proxy
- T1105Ingress Tool Transfer
- T1106Native API
- T1119Automated Collection
- T1140Deobfuscate/Decode Files or Information
- T1190Exploit Public-Facing Application
- T1199Trusted Relationship
- T1204.002Malicious File
- T1210Exploitation of Remote Services
- T1218.004InstallUtil
- T1553.002Code Signing
- T1560Archive Collected Data
- T1560.001Archive via Utility
- T1566.001Spearphishing Attachment
- T1568.001Fast Flux DNS
- T1574.001DLL
- T1583.001Domains
- T1588.002Tool
Recent victims
Loading…
Onion infrastructure
1 known- http://cicadabv7vicyvgz5khl7v2x5yygcgow7ryy6yppwmxii4eoobdaztqd.onion
Source
Updated 9 months agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
