NightSpire

Exploit Public-Facing Application (T1190) through primary exploitation of CVE-2024-55591 targeting FortiOS and FortiProxy authentication bypass in Node.js WebSocket module, enabling unauthenticated remote attackers to gain super-admin privileges via crafted requests to FortiGate firewall administrative interfaces.

Valid Accounts (T1078) using compromised RDP credentials obtained through brute-forcing and credential stuffing.

Phishing (T1566) campaigns deploying malicious attachments and drive-by downloads from compromised websites disguised as browser or security software updates. Additional vectors include exploitation of vulnerable VPN appliances, misconfigured web applications, and unpatched edge devices.

Network Service Discovery (T1046) via Advanced IP Scanner deployment for network mapping and identification of additional targets. File and Directory Discovery (T1083) using Everything.exe legitimate Voidtools application abused for comprehensive file enumeration.

System Information Discovery (T1082) conducting reconnaissance of system configurations, architecture, and security postures. Process Discovery identifying running services, security tools, and backup solutions.

Go-based loaders deployed via phishing and exploitation executing from temporary directories with renamed processes. Legitimate remote access utilities including AnyDesk and similar tools potentially abused for persistent access. PowerShell scripts and batch files functioning as primary execution mechanisms. PsExec serving dual purpose as lateral movement tool and remote command execution utility.

Masquerading (T1036) through renamed processes executing from temporary directories. System Binary Proxy Execution (T1218) via extensive living-off-the-land binary abuse including PowerShell, PsExec, WMI, and cmd.exe blending malicious activity with legitimate system operations.

Obfuscated Files or Information (T1027) employing custom obfuscation routines hindering detection and sandbox analysis.

Indicator Removal (T1070) through selective cleanup operations, notably the group does NOT delete Volume Shadow Copies, suggesting prioritization of encryption speed over complete recovery prevention.

OS Credential Dumping (T1003.001) via Mimikatz deployment for LSASS memory credential extraction and domain-level privilege escalation. Unsecured Credentials (T1552) through harvesting of stored credentials, cached authentication data, and credential files from compromised systems. Brute Force attacks targeting RDP services and administrative accounts with weak or default credentials.

Application Layer Protocol (T1071) using Tor-based communication channels for anonymity. Encrypted Channel (T1573) implementing asymmetric encrypted non-C2 protocols to evade intrusion detection systems. Multi-platform coordination via email (ProtonMail, OnionMail, Gmail), Telegram channel, and qTox encrypted messaging.

Remote Desktop Protocol (T1021.001) pivoting for host-to-host movement across compromised networks. SMB/Windows Admin Shares (T1021.002) via PsExec as primary lateral movement tool executing commands remotely via administrative shares. Windows Management Instrumentation (T1047) for remote command execution and lateral propagation. PowerShell remoting enabling script execution across multiple systems simultaneously.

Exfiltration to Cloud Storage (T1567.002) as primary method via MEGACmd to MEGA cloud storage for large-volume data theft. Exfiltration Over Alternative Protocol (T1048) using WinSCP transfers and Rclone utility for staged data exfiltration. Exfiltration Over C2 Channel (T1041) through encrypted TOR-proxied transfers.

Archive via Utility (T1560.001) employing 7-Zip for data compression and staging prior to exfiltration, with documented exfiltration volumes including 1.5TB from healthcare sector.

Registry Run Keys (T1547.001) through modifications to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce for payload execution on system restart. Scheduled Task/Job (T1053) creating Windows Task Scheduler entries for maintaining persistent access. Image File Execution Options registry manipulation for execution behavior control. Service creation and modification for long-term access maintenance.

System disruption through comprehensive file encryption across networks. Data loss preventing access to critical business files, databases, and backups. Business interruption requiring emergency incident response, forensic investigation, and recovery processes.

Data Encrypted for Impact (T1486) implementing hybrid AES-256 with RSA-2048 encryption scheme. Block encryption processes large files (.iso, .vhdx, .vmdk, .zip, .vib, .bak, .mdf, .flt, .ldf) in 1MB chunks using main_EncryptFilev2 function for performance optimization. Full encryption via main_EncryptFilev1 applies to documents and smaller files. Each file receives unique AES symmetric key encrypted with attacker's RSA public key appended to file tail.

Post-encryption files receive .nspire extension with readme.txt ransom notes placed in affected directories.

Dual-threat double extortion model combining system encryption with data publication threats. Aggressive pressure tactics including payment deadlines as short as 2 days from ransom note delivery, countdown timers on leak site (3 to 90 days depending on victim), and direct emails to employees pressuring organizations. Public shaming via Tor-based leak site featuring victim database with breach dates and data sizes, free download links for some leaked data, and threatening language.

Multi-channel intimidation through Telegram channels, publication of negotiation transcript excerpts for non-compliant victims, and threats to sell data to third parties if ransoms remain unpaid.

Selective indicator removal and log manipulation. Extended sleep intervals between encryption operations to evade real-time detection. Temporary file cleanup and process termination following payload execution.