Infection with Trickbot and delayed Ryuk ransomware combo

guest · Jan 12, 2019

TEMP.MixMaster group infects with Tickbot and delayed Ryuk ransomware combo
January 11, 2019
https://www.scmagazine.com/home/sec...efore-deploying-the-infamous-ryuk-ransomware/

Financially motivated threat actors,referred to as TEMP.MixMaster, are infecting victims with Trickbot malware before deploying the infamous Ryuk ransomware and so far have managed to make off with a reported $3.7 million worth of Bitcoin.

The attacks are also unique as the threat actors often wait for extended periods after gaining access, often profiting from the victims in other ways, before launching ransomware attacks.

FireEye researchers noted the threat actors have been active since at least december 2017 and while it’s unclear exactly who is behind the attacks numerous reports have attributed the campaign to North Korea, according to a Jan. 10 blog post.
Click to expand...

guest · Jun 23, 2020

Ryuk ransomware deployed two weeks after Trickbot infection
June 23, 2020
https://www.bleepingcomputer.com/ne...-deployed-two-weeks-after-trickbot-infection/

Activity logs on a server used by the TrickBot trojan in post-compromise stages of an attack show that the actor takes an average of two weeks pivoting to valuable hosts on the network before deploying Ryuk ransomware.

After compromising the network, the attacker starts scanning for live systems that have specific ports open and stealing password hashes from the Domain Admin group.
Once the actor took interest in a compromised network, they used modules from Cobalt Strike threat emulation software for red teams and penetration testers.
Dropping Ryuk
According to SentinelOne’s examination, the threat actor profiles each machine to extract as much useful information as possible. This allows them to take complete control of the network and get access to as many hosts as possible.

Reconnaissance and pivoting stages are followed by planting Ryuk ransomware and deploying it to all accessible machines using Microsoft’s PsExec tool for executing processes remotely.
Click to expand...

SentinelOne: Inside a TrickBot Cobalt Strike Attack Server

Trickbot operators utilized PowerTrick and Cobalt Strike to deploy their Anchor backdoor and RYUK ransomware

We review the Cobalt Strike portion of the server and how the actors were leveraging it against multiple targets.

Click to expand...

Log in or Sign up

Infection with Trickbot and delayed Ryuk ransomware combo

guest Guest

guest Guest

Log in or Sign up

Infection with Trickbot and delayed Ryuk ransomware combo

guest Guest

guest Guest

Useful Searches