Ransomware Hide and Seek: Top Tools and Tactics Exposed!
In December 2023, we stumbled upon an open directory filled with defense evasion scripts targeting antivirus and critical services. Threat actors used tools like Ngrok for proxy services and PoshC2 for command and control. The infrastructure has been active since September 2023, pointing to long-term malicious activity. Ten new sigma rules were created.
Hot Take:
If hackers spent half as much time creating defenses as they do evading them, we’d have a cybersecurity utopia. But alas, they’d rather play hide and seek with our data like it’s their favorite childhood game!
Key Points:
- Discovered open directory with scripts for disabling antivirus and stopping critical services.
- Scripts for deleting backups and logs, and installing/removing remote monitoring tools.
- Use of proxy tools like Ngrok and command and control frameworks like Sliver and PoshC2.
- Long-term usage by threat actors, active from September 2023 to August 2024.
- Ten new sigma rules have been created from this investigation.
Already a member? Log in here