Protected: DarkSide — Infrastructure analysis
There is no excerpt because this is a protected post.
Tag
ransomware
Read the analysis
Protected: DarkSide — The group and its evolution
There is no excerpt because this is a protected post.
REvil Ransomware Operator: A time zone analysis
In April 2021, an unidentified Gold Southfield operator carried out a Ransomware attack against a European company. The initial access is performed by Gold Cabin, an access broker, that deploys IceID (Bokbot), a Remote Access Tool (RAT) malware[link]. Once inside the company, the access broker passes privileges to the main operator who deploys the REvil ransomware. This threat actor … Read more
DarkSide Ransomware: the Colonial Pipeline hack
DarkSide ransomware in the Colonial Pipeline incident: initial access hypotheses, fuel supply disruption on the US East Coast, ransom payment and operational impact.
Mapping a cyber attack — the Italian case
Mapping a real Italian intrusion onto the MITRE ATT&CK framework: phases, techniques, telemetry sources and lessons for SOC detection-engineering.
50 000 companies compromised, 700 Italian organisations among them
Mass compromise impacting 50 000 organisations globally with 700 Italian entities affected: scope, exploitation chain and defensive priorities.
Under Ransomware attack — the story of an incident response
Field account of a ransomware incident response engagement: initial scoping, eradication, recovery decisions and lessons learned about preparation gaps.
