RansomHouse am See

MITRE Techniques

• [T1190] Exploit Public-Facing Application – Initial compromise through an exploit in Citrix. ‘Initial compromise through an exploit in Citrix’
• [T1078] Valid Accounts – Gaining control of weak domain user accounts. ‘Valid Accounts’ and ‘Gaining control of weak domain user accounts’
• [T1021.001] SMB/Windows Admin Shares – Lateral Movement. ‘Exploiting weak monitoring and analysis systems, the group was able to gain unauthorized access via SMB/RDP’
• [T1021.002] Remote Services – Lateral Movement. ‘Exploiting weak monitoring and analysis systems, the group was able to gain unauthorized access via SMB/RDP’
• [T1567.002] Exfiltration to Cloud Storage – Data exfiltration via CDN/cloud storage. ‘Utilized CDN servers for data exfiltration during attacks’
• [T1560.001] Archive Collected Data – Data compression/archival before exfiltration. ‘Collected data was compressed’
• [T1059.004] Unix Shell – Use of Unix/esxcli commands to gather system information and manipulate firewall settings. ‘Unix commands such as and esxcli commands to gather system information and manipulate firewall settings’
• [T1016] System Network Configuration Discovery – Retrieve MAC/IP addresses. ‘Retrieves MAC and IP address of the compromised system using esxcli commands and ioctl calls’
• [T1562.004] Impair Defenses: Disable Firewall – Disable ESXi firewall. ‘Disable the ESXi firewall by executing the command “esxcli network firewall set –enabled false”’
• [T1090] Proxy – Tor-based communications for C2. ‘Tor-based chat room’
• [T1583] Acquire Infrastructure: Server – Acquire infrastructure: server. ‘Acquire Infrastructure: Server’
• [T1071.001] Application Layer Protocol – C2 using JSON messages. ‘Messages to and from the command & control server are transmitted as JSON encoded strings with a zero-byte terminator’