Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Anatomy of Attack: Inside BazarBackdoor to Ryuk Ransomware "one" Group via Cobalt Strike

The analyzed threat involves a sophisticated attack chain leveraging the BazarBackdoor malware to deploy Ryuk ransomware, facilitated through the use of Cobalt Strike, a legitimate penetration testing tool often abused by threat actors. The attack sequence typically begins with initial compromise using BazarBackdoor, a stealthy backdoor malware that enables persistent remote access and lateral movement within targeted networks. Once foothold is established, the attackers deploy Cobalt Strike to conduct reconnaissance, escalate privileges, and move laterally across the environment. Ultimately, the Ryuk ransomware payload is delivered and executed, encrypting critical data and demanding ransom payments. This attack vector is notable for its complexity and use of multiple advanced tools, combining stealthy backdoor access with powerful post-exploitation frameworks and destructive ransomware. The "one" group referenced is known for targeted ransomware campaigns against high-value organizations, often involving manual intrusion and tailored attacks. The use of OSINT (Open Source Intelligence) in analyzing this attack provides insight into the tactics, techniques, and procedures (TTPs) employed, highlighting the persistent and evolving nature of this threat. The threat level is high due to the potential for significant operational disruption and financial loss. Although no specific affected versions or patches are listed, the attack relies on social engineering, exploitation of network vulnerabilities, and misuse of legitimate tools rather than a single software flaw. The lack of known exploits in the wild suggests the attack is more targeted and manual rather than widespread automated exploitation. The certainty of the OSINT is moderate (50%), indicating some confidence in the analysis but also room for further validation.

Detailed information about OSINT - Anatomy of Attack: Inside BazarBackdoor to Ryuk Ransomware "one" Group via Cobalt Strike. Get real-time updates, technical de

OSINT - Anatomy of Attack: Inside BazarBackdoor to Ryuk Ransomware "one" Group via Cobalt Strike - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided information pertains to an OSINT (Open Source Intelligence) indicator set related to the Ryuk ransomware, as compiled by SEKOA and shared via GitHub. Ryuk ransomware is a well-known malware family that has been active since 2018 and is primarily used in targeted ransomware attacks against organizations, encrypting files and demanding ransom payments. The SEKOA IOC (Indicators of Compromise) dataset likely contains hashes, IP addresses, domains, or other artifacts associated with Ryuk activity, intended to aid detection and response efforts. However, the provided data does not include specific technical details about Ryuk's infection vectors, encryption methods, or command and control infrastructure. The threat is classified as medium severity with a threat level and analysis rating of 2 (on an unspecified scale), and the certainty of the OSINT data is moderate (50%). No known exploits in the wild are indicated, suggesting this dataset is primarily for detection rather than describing a new vulnerability or exploit. The information is tagged as TLP:WHITE, meaning it is intended for wide distribution and sharing. Overall, this dataset serves as a threat intelligence resource to help organizations identify Ryuk ransomware activity through known indicators, rather than describing a novel or active exploit or vulnerability.

Detailed information about SEKOA IOC - CSV GitHub - Ryuk. Get real-time updates, technical details, and mitigation strategies.

SEKOA IOC - CSV GitHub - Ryuk - Live Threat Intelligence - Threat Radar | OffSeq.com

SEKOA IOC - CSV GitHub - Ryuk

OSINT - Ryuk Ransomware: Extensive Attack Infrastructure Revealed

Ryuk ransomware is a well-known strain of ransomware that has been active since 2018 and is primarily used in targeted attacks against large organizations, including healthcare, government, and critical infrastructure sectors. The provided information reveals an OSINT report from CIRCL detailing an extensive attack infrastructure associated with Ryuk ransomware. Although specific technical details and indicators are not provided in this summary, Ryuk is typically deployed via phishing campaigns, exploitation of Remote Desktop Protocol (RDP) vulnerabilities, and through initial access brokers who sell access to compromised networks. Once inside a network, Ryuk operators conduct reconnaissance, lateral movement, and deploy the ransomware payload to encrypt critical files, demanding large ransom payments in cryptocurrency. The infrastructure supporting Ryuk includes command and control (C2) servers, malware distribution points, and payment processing mechanisms. The medium severity rating and a threat level of 2 indicate a moderate but persistent threat, with a 50% certainty level in the OSINT data. No known exploits in the wild are reported in this summary, suggesting that the threat is more about the operational infrastructure and ongoing campaigns rather than a new vulnerability or exploit. The perpetual lifetime tag indicates that the Ryuk threat infrastructure remains active and relevant over time.

Detailed information about OSINT - Ryuk Ransomware: Extensive Attack Infrastructure Revealed. Get real-time updates, technical details, and mitigation strategie

OSINT - Ryuk Ransomware: Extensive Attack Infrastructure Revealed - Live Threat Intelligence - Threat Radar | OffSeq.com

Ryuk ransomware is a well-known strain of ransomware that has been actively used by threat actors, often associated with the UNC1878 group, to conduct targeted attacks primarily on enterprises and organizations. Ryuk operates by encrypting critical files on infected systems and demanding a ransom payment in cryptocurrency to restore access. It is typically deployed after initial access is gained through other malware or phishing campaigns, often leveraging lateral movement and privilege escalation techniques to maximize impact. The ransomware is known for its precision targeting of high-value victims, including healthcare, government, and large corporations, aiming to disrupt operations and extract significant ransoms. Although the provided information does not specify affected versions or exploits in the wild, Ryuk's operational history indicates a persistent threat with a medium threat level. The analysis certainty is moderate (50%), reflecting some uncertainty in attribution or current activity status. The lack of patch links and known exploits suggests that Ryuk is not exploiting a specific software vulnerability but rather relies on social engineering, compromised credentials, or other malware as initial infection vectors. The threat level and analysis scores of 2 indicate a moderate concern, consistent with Ryuk's known impact and operational complexity.

Detailed information about unc1878 - ryuk. Get real-time updates, technical details, and mitigation strategies.

unc1878 - ryuk - Live Threat Intelligence - Threat Radar | OffSeq.com

unc1878 - ryuk

Ransomware Activity Targeting the Healthcare and Public Health Sector

This threat concerns ransomware activity specifically targeting the Healthcare and Public Health (HPH) sector, with a focus on the Ryuk ransomware family. Ryuk ransomware is a well-known and highly disruptive malware strain that encrypts victims' data and demands ransom payments in cryptocurrency to restore access. The targeting of healthcare organizations is particularly concerning due to the critical nature of their services, the sensitivity of patient data, and the potential for life-threatening disruptions. Ryuk typically gains initial access through phishing campaigns, exploitation of remote desktop protocol (RDP) vulnerabilities, or via other malware infections that provide a foothold. Once inside the network, attackers perform reconnaissance, escalate privileges, and deploy the ransomware payload to encrypt files across multiple systems, often including backups, to maximize impact. The ransomware's encryption is strong and designed to prevent recovery without the decryption key. The threat intelligence indicates a high severity level with a 50% certainty rating, suggesting active or imminent campaigns against healthcare targets. Although no specific affected software versions or exploits are listed, the persistent targeting of healthcare entities by Ryuk ransomware is well documented. The lack of known exploits in the wild for a specific vulnerability implies that the attack vector relies on social engineering, credential compromise, or exploitation of general network weaknesses rather than zero-day vulnerabilities. The threat level and analysis scores indicate a credible and significant risk to healthcare infrastructure.

Detailed information about Ransomware Activity Targeting the Healthcare and Public Health Sector. Get real-time updates, technical details, and mitigation strat

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:ransomware="ryuk ransomware"'

Filter Threats

Threats Tagged 'misp-galaxy:ransomware="ryuk ransomware"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility