Inactive ransomware operator
← All groupsLv
115 victims indexed · first seen 4 years ago · last activity 2 years ago
At a glance
- Status
- inactive
- First seen
- 4 years ago
- Last activity
- 2 years ago
- Onion sites
- 4 known endpoints
- Primary sector
- Energy · 4 hits
About
References
3 linksExternal sources curated by the MISP threat-intel community.
Timeline
13 monthsTop countries
Top sectors
MITRE ATT&CK
22 techniques · 10 tacticsTactics
Techniques
- T1021.002SMB/Windows Admin Shares
- T1036.005Match Legitimate Resource Name or Location
- T1037.004RC Scripts
- T1040Network Sniffing
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1055Process Injection
- T1059.004Unix Shell
- T1071Application Layer Protocol
- T1078.003Local Accounts
- T1083File and Directory Discovery
- T1090.001Internal Proxy
- T1132Data Encoding
- T1133External Remote Services
- T1211Exploitation for Stealth
- T1569.002Service Execution
- T1570Lateral Tool Transfer
- T1571Non-Standard Port
- T1573.002Asymmetric Cryptography
- T1574.001DLL
- T1685Disable or Modify Tools
- T1686Disable or Modify System Firewall
Recent victims
Loading…
Onion infrastructure
4 known- http://4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion
- http://4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion/
- http://rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion
- http://rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion/api/posts/1
Source
Updated 2 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
