Threats Tagged 'mimic'

The Trigona threat actor continues to target MS-SQL servers through brute-force and dictionary attacks, exploiting weak credentials. They use CLR Shell for additional payloads and employ various tools like BCP, Curl, Bitsadmin, and PowerShell to install malware. The attackers utilize remote control tools such as AnyDesk, RDP, and possibly Teramind. New scanner malware written in Rust targets RDP and MS-SQL services. The threat actor also uses tools like SpeedTest and a custom StressTester. Various privilege escalation and file manipulation tools are employed. To protect against these attacks, administrators should use complex passwords, regularly update security software, and implement firewalls to control access to database servers.

MediumMalwareGermanyUnited KingdomFrance+4#remote-control#ransomware#trigona

Pay2Key, an Iranian-backed ransomware-as-a-service operation, has re-emerged as Pay2Key.I2P, targeting Western organizations. Linked to the Fox Kitten APT group and collaborating with Mimic ransomware, the campaign has collected over $4 million in ransom payments in four months. The group offers an 80% profit share to affiliates supporting Iran or attacking its enemies, blending financial motivations with geopolitical objectives. Pay2Key.I2P employs sophisticated evasion techniques, including anti-analysis checks and obfuscation methods. The operation's strategic marketing on darknet forums and social media platforms indicates a planned rollout, with the addition of Linux-targeted ransomware expanding their attack surface.

MediumCampaignGermanyFranceUnited Kingdom+5#ransomware#raas#cyber warfare