Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The threat campaign titled "Trickbot to Ryuk in Two Hours" describes a rapid attack chain leveraging the Trickbot malware to deploy Ryuk ransomware within a very short timeframe, approximately two hours. Trickbot is a modular banking Trojan that has evolved into a versatile malware platform used for credential theft, lateral movement, and network reconnaissance. In this campaign, Trickbot is used to gain initial access, perform extensive network and system discovery, credential dumping, and disable security tools to evade detection. The attack employs multiple MITRE ATT&CK techniques such as scheduled tasks (T1053) for persistence, disabling security tools (T1089), group policy modification (T1484), process injection (T1055), and obfuscated files or information (T1027) to maintain stealth and control. The adversaries leverage valid accounts (T1078) and credential dumping (T1003) to escalate privileges and move laterally across the network. Discovery techniques include system network connections (T1049), software and security software discovery (T1518, T1063), remote system discovery (T1018), and network share discovery (T1135). Remote services (T1021), remote desktop protocol (T1076), and remote file copy (T1105) facilitate lateral movement and payload deployment. The final stage involves deploying Ryuk ransomware, which encrypts data for impact (T1486), causing significant operational disruption. The campaign is known to utilize tools like Cobalt Strike and PowerView for post-exploitation activities. The rapid progression from initial compromise to ransomware deployment underscores the high operational tempo and sophistication of the threat actors behind this campaign.

Detailed information about Trickbot to Ryuk in Two Hours. Get real-time updates, technical details, and mitigation strategies.

Trickbot to Ryuk in Two Hours - Live Threat Intelligence - Threat Radar | OffSeq.com

Trickbot to Ryuk in Two Hours

SectorJ04 Groupâ€™s Increased Activity in 2019

The SectorJ04 threat group, also known as TA505, demonstrated increased activity in 2019 involving a broad range of sophisticated attack techniques primarily targeting Windows environments. This group employs spearphishing methods, including malicious attachments (T1193) and links (T1192), often leveraging trusted relationships (T1199) to gain initial access. Once inside a network, they utilize various execution techniques such as command-line interface (T1059), PowerShell (T1086), rundll32 (T1085), scheduled tasks (T1053), scripting (T1064), service execution (T1035), and execution through API or module loading (T1106, T1129). They also exploit client-side vulnerabilities (T1203) and user execution (T1204) to facilitate payload delivery.

For defense evasion, SectorJ04 uses methods like DLL side-loading (T1073), disabling security tools (T1089), bypassing User Account Control (T1088), code signing (T1116), obfuscation (T1027), software packing (T1045), virtualization/sandbox evasion (T1497), and hiding windows (T1143). Persistence is maintained through account manipulation (T1098), new services (T1050), registry run keys/startup folders (T1060), startup items (T1165), and WMI event subscriptions (T1084). They conduct extensive discovery activities including account (T1087), file and directory (T1083), network service scanning (T1046), network share (T1135), permission groups (T1069), process (T1057), registry queries (T1012), remote system (T1018), security software (T1063), system information (T1082), network configuration (T1016), network connections (T1049), system owner/user (T1033), and system service discovery (T1007).

For lateral movement and command and control, they use remote desktop protocol (T1076), remote services (T1021), custom and standard application layer protocols (T1094, T1071), and cryptographic protocols (T1024, T1032). Data collection techniques include automated collection (T1119), local system data (T1005), and email collection (T1114). Exfiltration is performed via automated exfiltration (T1020), alternative protocols (T1048), and command and control channels (T1041), often compressing (T1002) and encrypting data (T1486) to evade detection. This comprehensive attack lifecycle demonstrates SectorJ04's capability to conduct complex, multi-stage intrusions with a focus on stealth and persistence.

Although no specific affected software versions or exploits in the wild are documented, the group's tactics align with advanced persistent threat (APT) behavior targeting enterprise environments, particularly those with Windows infrastructure. The low severity rating likely reflects the absence of a single exploitable vulnerability but rather a combination of social engineering and post-compromise techniques.

Detailed information about SectorJ04 Groupâ€™s Increased Activity in 2019 affecting misp-galaxy mitre-attack-pattern. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="network service scanning - t1046"'

Filter Threats