DaRansom Active
Data auction model0
Total Victims
2024-07-01
First Seen
N/A
Last Seen
19
Known TTPs
24.3d
Avg Delay
0
Negotiations
ONION URLS
t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion
TOOLS
Data auction platform
ACTIVITY TIMELINE
TOP SECTORS
TOP COUNTRIES
ACTIVITY HEATMAP
| Date | Victim Name | Country | Sector | Status |
|---|---|---|---|---|
| No victims recorded | ||||
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1039 | Data from Network Shared Drive | Collection |
| T1074.001 | Local Data Staging | Collection |
| T1219 | Remote Access Software | Command and Control |
| T1003.001 | LSASS Memory | Credential Access |
| T1003.003 | NTDS | Credential Access |
| T1555.003 | Credentials from Web Browsers | Credential Access |
| T1558.003 | Kerberoasting | Credential Access |
| T1036.005 | Match Legitimate Name or Location | Defense Evasion |
| T1070.004 | File Deletion | Defense Evasion |
| T1016 | System Network Configuration Discovery | Discovery |
| T1069 | Permission Groups Discovery | Discovery |
| T1083 | File and Directory Discovery | Discovery |
| T1059.005 | Visual Basic | Execution |
| T1059.006 | Python | Execution |
| T1041 | Exfiltration Over C2 Channel | Exfiltration |
| T1486 | Data Encrypted for Impact | Impact |
| T1489 | Service Stop | Impact |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
| T1136.001 | Local Account | Persistence |
No YARA rules
No IoCs
No ransom notes