Threat Actor Groups
Comprehensive CTI Report: Insights from the LockBit Ransomware Group Data Dump
Executive Summary This report analyzes a leaked database dump from the LockBit ransomware group, providing actionable insights into their operations, tactics, and infrastructure. Key findings include the identification of Bitcoin addresses used for ransom payments, operator activity patterns, negotiation tactics, and targeted industries. These insights can help security professionals detect, mitigate, and respond to LockBit…
Read MoreComprehensive CTI Report: Scattered Spider Threat Actor Group
Purpose: To provide an exhaustive analysis of the Scattered Spider threat actor group, detailing their profile, payloads, tactics, techniques, and procedures (TTPs), MITRE ATT&CK framework mappings, methods for proactively tracking their networks using tools like Shodan, and their affiliations with other threat actor groups, incorporating recent insights from the Google Mandiant report. Executive Summary Scattered…
Read MoreExecutive Summary: ShadowSyndicate Threat Group
Executive Summary In late 2024, Darktrace identified multiple instances of RansomHub ransomware attacks linked to the ShadowSyndicate threat group. ShadowSyndicate, active since 2022, has been associated with several ransomware families and sophisticated tools, including Cobalt Strike and Sliver. Their latest collaboration with RansomHub, a rising Ransomware-as-a-Service (RaaS) operator, underscores an evolving threat landscape. This report…
Read MoreBianLian Data Extortion Group – Updated Advisory
The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) have released a joint Cybersecurity Advisory detailing the tactics, techniques, and procedures (TTPs) of the BianLian ransomware and data extortion group. This advisory, updated as of November 20, 2024, provides critical…
Read MoreREMCOS Remote Control & Surveillance Software
What Is Remcos? aka: RemcosRAT, Remvio, Socmer Actor(s): APT33, The Gorgon Group, UAC-0050 Remcos (short for Remote Control and Surveillance) is a commercial system administration application for XP and newer versions of Windows that threat actors have weaponized. Remcos is a closed-source application designed for network maintenance, system monitoring, surveillance, and penetration testing, but attackers use it to…
Read More