Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro

The provided information relates to the Backmydata ransomware, associated with the Phobos ransomware family, as identified through OSINT (Open Source Intelligence) indicators of compromise (IOCs). Phobos ransomware is known for targeting external remote services, particularly publicly accessible Remote Desktop Protocol (RDP) services, to gain unauthorized access to victim networks. The attack pattern involves exploiting public-facing applications (MITRE ATT&CK T1190) and leveraging external remote services (T1133) to deliver ransomware payloads. Once access is gained, the ransomware encrypts critical data, demanding payment for decryption keys. The threat is categorized under malware and ransomware, with a medium severity rating. The technical details are limited, with no specific affected versions or patches available, and no known exploits in the wild reported at this time. The sector tag indicates a focus on the health sector, which is often targeted due to the critical nature of its data and services. The lack of patch availability suggests that the attack vector is more about exploiting misconfigurations or weak security controls (such as exposed RDP services) rather than software vulnerabilities. Indicators of compromise are not detailed in the provided data, but the emphasis on publicly accessible RDP services and exploitation of public-facing applications highlights the attack surface. This threat underscores the importance of securing remote access points and monitoring for suspicious activity related to external remote services.

Detailed information about OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro. Get real-time updates, technical details, and mitig

OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided information pertains to the Backmydata ransomware threat, specifically focusing on Indicators of Compromise (IOCs) related to the Phobos ransomware family. This threat is characterized by exploitation of publicly accessible remote services, particularly Remote Desktop Protocol (RDP) services, which are commonly targeted entry points for ransomware campaigns. The attack vectors align with MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application) and T1133 (External Remote Services), indicating that attackers leverage vulnerabilities or weak configurations in externally facing services to gain unauthorized access. Once access is obtained, the Phobos ransomware payload is deployed, encrypting victim data and demanding ransom payments. The threat is notably associated with the healthcare sector, which is a frequent target due to the critical nature of its operations and the high value of its data. The absence of specific affected versions or patch availability suggests that this is an ongoing threat relying on exploitation of configuration weaknesses rather than software vulnerabilities with patches. The presence of known exploits in the wild and active ransomware campaigns underscores the immediacy and real-world impact of this threat. The OSINT nature of the data indicates that these IOCs and alerts are publicly accessible, facilitating detection and response efforts but also enabling threat actors to adapt. Overall, this threat represents a medium-severity risk focused on leveraging exposed remote services to deliver ransomware payloads, with significant implications for targeted organizations.

Detailed information about OSINT - Backmydata Ransomware Indicators of Compromise (IOCs) - alerts - dnsc.ro affecting type osint. Get real-time updates, technic

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:sigma-rules="publicly accessible rdp service"'

Filter Threats

Threats Tagged 'misp-galaxy:sigma-rules="publicly accessible rdp service"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility