Inactive ransomware operator
← All groupsplayboy
1 victims indexed · first seen 2 years ago · last activity 2 years ago
At a glance
- Status
- inactive
- First seen
- 2 years ago
- Last activity
- 2 years ago
- Onion sites
- 1 known endpoint
- Primary sector
- Government · 1 hits
About
References
1 linkExternal sources curated by the MISP threat-intel community.
Timeline
1 monthsTop countries
Top sectors
MITRE ATT&CK
26 techniques · 14 tacticsTactics
Techniques
- T1003.001LSASS Memory
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021.002SMB/Windows Admin Shares
- T1027.010Command Obfuscation
- T1030Data Transfer Size Limits
- T1048Exfiltration Over Alternative Protocol
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1070.004File Deletion
- T1078Valid Accounts
- T1078.002Domain Accounts
- T1078.003Local Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1105Ingress Tool Transfer
- T1133External Remote Services
- T1190Exploit Public-Facing Application
- T1518.001Security Software Discovery
- T1560.001Archive via Utility
- T1587.001Malware
- T1588.002Tool
- T1657Financial Theft
- T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs
Recent victims
Loading…
Onion infrastructure
1 known- http://vlofmq2u3f5amxmnblvxaghy73aedwta74fyceywr6eeguw3cn6h6uad.onion
Source
Updated 2 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
