Threats Tagged 'ta0003'

Gunra Ransomware is a double extortion group targeting global victims, excluding the US. They primarily attack Windows systems, recently expanding to Linux. The group uses phishing as their main vector and negotiates through a WhatsApp-themed chat panel. They can encrypt large files quickly using advanced stream ciphers. The Data Leak Site has undergone several changes, including a brief clearweb presence. Victims span multiple countries and industries, with South Korea, Brazil, and Japan topping the list. The ransomware shares code similarities with Conti and Akira, but newer versions appear unique. Negotiations reveal ambitious ransom demands, sometimes unrealistic. The group employs various evasion techniques and uses multiple MITRE ATT&CK tactics.

MediumMalwareCroatiaItalySouth Korea+8#windows#lumma stealer#encryption

A recent analysis of a suspicious trojan loader reveals similarities to the APT-C-00 (Ocean Lotus) group, a government-backed hacker organization targeting East Asian companies and government agencies. The sample, a DLL file with excellent evasion capabilities, uses hash algorithms to dynamically obtain API functions. It creates a mutex for single-instance execution, validates command-line parameters, adds itself to the registry for persistence, and sets up a VEH exception handler. The loader employs module hollowing to replace code in certmgr.dll with shellcode that reflectively loads the Havoc RAT. The tactics and development environment align with Ocean Lotus' known techniques, including the use of Mingw-w64 and similar initialization processes.

MediumMalwareGermanyFranceUnited Kingdom+4#process hollowing#apt#east asia