Play

Exploits ProxyNotShell, OWASSRF, and Fortinet SSL VPN flaws including CVE-2018-13379, CVE-2020-12812, and Microsoft Exchange vulnerabilities CVE-2022-41040/41082. Abuses stolen credentials from dark web markets and leverages Initial Access Brokers for pre-compromised environments.

Recent campaigns exploit SimpleHelp RMM tools via CVE-2024-57727. External-facing services like RDP and VPN connections without MFA provide additional entry vectors through public-facing application exploitation.

Deploys Grixba information stealer for comprehensive network reconnaissance alongside ADFind for Active Directory queries and BloodHound to map privilege escalation paths.

Utilizes PowerShell scripts and Windows Management Instrumentation (WMI) for system enumeration and identification of high-value targets. nltest identifies domain controllers while WMiC gathers detailed system and disk information for targeting decisions.

‍

Establishes control through SystemBC RAT deployment, creating SOCKS5 proxy connections for persistent access. Cobalt Strike beacons provide redundant command infrastructure. SystemBC functions as both malware and proxy tunnel on port 443, while RDP and VPN connections maintain alternative access channels.

Disables defenses using custom PowerShell scripts targeting endpoint protection and specific tools including GMER, IOBit, PowerTool, and Process Hacker to neutralize AV/EDR solutions. Leverages LOLBins to blend malicious activity with legitimate system operations.

‍Binary recompilation ensures unique file hashes for each deployment. Modifies firewall rules through netsh commands while PowerShell scripts specifically target Microsoft Defender for complete security bypass. Utilizes WinPEAS, EscalatePC, Nskm and PrivCMD tools for privilege escalation through misconfiguration exploitation.

Harvests credentials through Mimikatz deployment and LSASS memory dumping using ProcDump. Targets stored credentials in browsers and credential managers for expanded access. Performs Kerberoasting via tools like Rubeus for offline password cracking.

Searches for plaintext credentials in unsecured storage locations while specifically targeting service accounts and admin accounts to maximize privileged access across the environment. Mirokatz credential dumper facilitates domain admin access.

‍

Operates Tor-based infrastructure with watermark 206546002 for Cobalt Strike beacons. SystemBC provides encrypted SOCKS5 tunnels on port 443 for persistent communications. PsExec enables remote command execution across compromised systems.

Scheduled tasks ensure persistence and automated payload execution, with Group Policy Objects distributing executables enterprise-wide.

Uses PsExec, SMB, and RDP for network traversal. SSH tunnels on non-standard ports provide alternative movement paths in Linux environments. Cobalt Strike facilitates automated lateral movement through built-in capabilities. Scheduled tasks propagate malware to new systems through automated deployment.

Group Policy Objects distribute malicious executables domain-wide through legitimate administrative channels.

Extracts sensitive data with WinRAR, WinSCP, and custom tools like Grixba before encryption. VSS copier enables rapid extraction of critical files from shadow copies. Compresses data into .RAR format using WinRAR before transfer via WinSCP for secure file transfer.

Uses chunked exfiltration to avoid network detection thresholds while targeting intellectual property and business-critical data to maximize extortion leverage.

Persistence mechanisms establish short-term persistence through registry modifications and scheduled tasks. Focuses on rapid execution rather than long-term persistence to minimize detection opportunities. ‍

Cobalt Strike maintains persistent beacons through service creation and registry autostart entries, implementing just enough persistence to complete encryption operations.

Encrypts files using hybrid AES/RSA encryption, leaving .PLAY extensions and ransom notes threatening public exposure. Targets critical business operations to maximize disruption and payment likelihood.

The combination of data encryption and exfiltration creates dual pressure points, while strategic targeting of operational technology ensures maximum business impact.

Deploys intermittent encryption processing 0x100000 byte chunks using hybrid AES-256/RSA-4096 algorithms. Targets both local drives and network shares while avoiding system-critical directories. AES-RSA hybrid encryption with intermittent processing optimizes speed while ransomware binary recompilation for each deployment evades signature detection.

The ESXi variant specifically targets virtual environments with AES-256 encryption, powering down VMs before encryption to ensure complete data lock.

Combines encryption with data theft threats on dark web site (DWS) platforms. Employs phone harassment and personalized communications to increase psychological pressure on decision-makers.

Executes cmdpostfix.bat for evidence removal. Clears event logs using wevtutil and removes tool artifacts from C:\Users\Public\Music staging directory, systematically deleting attack tools to minimize forensic evidence available to incident responders.

Deploys ALPHAVSS to delete shadow copies and prevent recovery through native Windows mechanisms, targeting backup systems to ensure disruption.

‍