Thus Spoke…The Gentlemen

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The group targets exposed edge devices and management interfaces for initial access, including Fortinet and Cisco systems [‘initial access through exposed edge devices such as VPN appliances, firewalls… platforms like Fortinet FortiGate and Cisco’]
• [T1110] Brute Force – They use credential brute-forcing against web or VPN panels and search for accounts and credentials in breach-search engines [‘credential brute-forcing against web or VPN panels’, ‘searching for accounts and credentials in data-breach search engines’]
• [T1557] Adversary-in-the-Middle – They rely on NTLM relay and reflection workflows as part of access and scanning operations [‘NTLM relay issues’, ‘CVE-2025-33073’]
• [T1078] Valid Accounts – They use OWA/M365 credential logs, harvested sessions, and stolen credentials to reuse existing access [‘OWA/M365 credential logs’, ‘harvest credentials and browser-based sessions’]
• [T1068] Exploitation for Privilege Escalation – They pursue privilege escalation through Active Directory discovery, certificate abuse, MSI service abuse, and other local escalation paths [‘obtain higher-level permissions’, ‘certificate abuse’, ‘MSI service abuse’]
• [T1021] Remote Services – They establish footholds and move through systems using VPNs, tunnels, WinRM/SMB-style tooling, and remote access frameworks [‘Cloudflare tunnels or Zero Trust solutions’, ‘NetExec (NXC)’]
• [T1040] Network Sniffing – The group searches for exposed credentials and accounts, and uses relay-style operations to capture authentication flows [‘searches for accounts and credentials’, ‘NTLM relay scanning’]
• [T1112] Modify Registry – They mention registry abuse as part of bypassing defensive tools and enabling persistence/escalation [‘using… registry abuse’]
• [T1562.001] Disable or Modify Tools – They attempt to disable or bypass EDR/AV via kill kits, ETW patching, unhooking, and logging tampering [‘disabling or bypassing security tools such as EDR and antivirus’, ‘patching ETW’, ‘NTDLL unhooking’]
• [T1053] Scheduled Task/Job – They use task-based abuse tools and persistence helpers in post-exploitation workflows [‘TaskHound’, ‘task and privilege abuse / persistence helper’]
• [T1018] Remote System Discovery – They perform reconnaissance across internal networks after gaining a foothold [‘perform internal reconnaissance’, ‘understand the environment’]
• [T1027] Obfuscated Files or Information – They use EDR evasion, custom lockers, and logging suppression to conceal activity [‘suppress Event Tracing for Windows’, ‘locker’s “spread” module’]
• [T1041] Exfiltration Over C2 Channel – They move stolen data through automated tools and tuned configurations, often from NAS, backups, and virtualization infrastructure [‘Data exfiltration is then carried out using automated tools and tuned configurations’]
• [T1486] Data Encrypted for Impact – They deploy a custom ransomware locker to encrypt systems across the network [‘deploy their custom ransomware “locker”’, ‘encrypt systems in a coordinated manner’]