Fog

public reporting will tie initial access in a consequential incident or bounded campaign to artifacts obtained through a separate, earlier edge-appliance exposure

Attacks leveraged compromised VPN appliances for access... Similar to the previous events, the threat actor used a compromised VPN appliance for access...

The vulnerability, CVE-2024-40711, was used as part of a threat activity cluster we named STAC 5881.

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

These commands use “Invoke-WebRequest” to download a PowerShell script named “stage1.ps1” ... executed in memory using Invoke-Expression (IEX).

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

public reporting will tie initial access in a consequential incident or bounded campaign to artifacts obtained through a separate, earlier edge-appliance exposure

Attacks leveraged compromised VPN appliances for access... Similar to the previous events, the threat actor used a compromised VPN appliance for access...

...used the VEEAM vulnerability to create a new local administrator account named “point”. Similar to the previous events... created a new account named ‘point’. However in this incident a ‘point2’ account was also created.

Windows only executes files located directly in the root of the Startup folder.

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

ktool.exe ... drops and loads the vulnerable driver (CVE-2015-2291) “iqvw64e.sys” as part of a Bring Your Own Vulnerable Driver (BYOVD) technique.

public reporting will tie initial access in a consequential incident or bounded campaign to artifacts obtained through a separate, earlier edge-appliance exposure

Locating the SYSTEM process token in memory and assigning it to the ransomware process.

Windows only executes files located directly in the root of the Startup folder.

public reporting will tie initial access in a consequential incident or bounded campaign to artifacts obtained through a separate, earlier edge-appliance exposure

Locating the SYSTEM process token in memory and assigning it to the ransomware process.

The script collects details such as the victim’s local and external IP addresses, the MAC address of the device, network adapters, the BSSID ... and the gateway’s IP.

The script collects data such as the UUID, BIOS serial number, disk specifications, CPU details, core count, RAM size, and operating system information.

A qualifying case must clear four gates: Previously exposed artifacts are successfully reused. The reuse enables initial access in a consequential incident or bounded campaign.

PsExec and direct access to administrative shares (ADMIN$, C$, etc.) remained present in some engagements... The most common approach involved executing the ransomware binary from a single compromised system — typically a domain controller or infrastructure server — and encrypting data on remote systems through administrative shares (ADMIN$, C$).

Lootsubmit.ps1 ... is designed to gather extensive information from a victim’s machine, including both system-related and network-related details.

The script proceeds to download “ktool.exe,” a kernel exploit tool ... and saves it to the %TEMP% directory.

After successfully encrypting files with the “.flocked” extension, it drops a “readme.txt” ransom note in every affected folder.

Deletes the shadow volume copy using the command “vssadmin.exe delete shadows /all /quiet”.