MalwarePublished 8 Sep 2025Updated 8 Oct 2025

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

Source AlienVault OTX General

Description

An intrusion began with a user downloading and executing a malicious file impersonating DeskSoft's EarthTime application, which deployed SectopRAT malware. The threat actor used multiple malware families, including SystemBC and Betruger, and various tools for reconnaissance and lateral movement. They moved across systems using RDP and Impacket's wmiexec, maintaining persistence through local account creation and startup folder shortcuts. Data was collected using WinRAR and exfiltrated via WinSCP to an FTP server. The discovery of tools linked to Play ransomware, DragonForce ransomware, and RansomHub suggests the threat actor was likely an affiliate operating across multiple ransomware groups.

Impact

For European organizations, this threat poses significant risks to confidentiality, integrity, and availability of critical data and systems. The use of multiple malware families and lateral movement techniques increases the likelihood of widespread compromise within networks, potentially affecting multiple departments or subsidiaries. Data exfiltration activities threaten sensitive corporate and personal data, which could lead to regulatory penalties under GDPR and damage to organizational reputation. The involvement of ransomware gangs implies a high risk of subsequent ransomware deployment, which could result in operational disruption, financial losses from ransom payments, and costs associated with incident response and recovery. European entities with remote access enabled via RDP or those lacking robust network segmentation are particularly vulnerable. The multi-group affiliation of the threat actor complicates detection and response, as indicators of compromise may vary and evolve rapidly. Additionally, the use of legitimate tools like WinRAR and WinSCP for malicious purposes challenges traditional signature-based defenses, necessitating advanced behavioral monitoring.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to this threat's characteristics. First, enforce strict controls on software downloads and execution, including application whitelisting and user education to prevent execution of impersonated applications like the fake EarthTime. Harden RDP access by disabling it if not required, or securing it with multi-factor authentication, strong passwords, and network-level authentication. Monitor and restrict the use of administrative tools such as Impacket's wmiexec, and implement robust logging and alerting for unusual lateral movement activities. Employ endpoint detection and response (EDR) solutions capable of detecting persistence mechanisms like local account creation and startup folder modifications. Network segmentation should be enforced to limit lateral movement opportunities. Monitor data archiving and transfer activities, particularly the use of WinRAR and WinSCP, with anomaly detection to identify unauthorized data exfiltration. Regularly audit user accounts and remove unnecessary local accounts. Finally, maintain up-to-date backups isolated from the network to enable recovery in case of ransomware deployment. Incident response plans should be updated to address multi-affiliate ransomware threats and include threat intelligence sharing with relevant European cybersecurity authorities.

Indicators of compromise

Domains 2

504e1c95.host.njalla.net
504ec1c95.host.njalla.net

IP addresses 2

45.141.87.55
80.78.28.149

Hashes 30

12011c44955fd6631113f68a99447515
27f7186499bc8d10e51d17d3d6697bc5
5675a7773f6d3224bfefdc01745f8411
71f703024c3d3bfc409f66bb61f971a0
829a9dfd2cdcf50519a1cec1f529854b
88df27b6e794e3fd5f93f28b1ca1d3d0
95c96de7dcb5a643559ac66045559cc9
abb2a6a0f771ab20ce2037d2c4ef5783
c6f92d1801d7d212282a6dd8f11b44fe
e963d598a86c5ee428a2eefa34d1ffbb

Community reviews

Loading reviews…