ElectraHack Inactive
Ransomware group first observed in 2019. Uses ConnectWise for deployment.0
Total Victims
2019-11-01
First Seen
2020-12-12
Last Seen
18
Known TTPs
38.2d
Avg Delay
0
Negotiations
ONION URLS
mbpvwpf2qw3zxjbkefhm4c2hvn5wvuxu2wsssyv3sa3zamjolupncguo.onion
TOOLS
ConnectWise
SharpHound
TeamViewer
BazarLoader
FILE EXTENSIONS
.locked
ACTIVITY TIMELINE
TOP SECTORS
TOP COUNTRIES
ACTIVITY HEATMAP
| Date | Victim Name | Country | Sector | Status |
|---|---|---|---|---|
| No victims recorded | ||||
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1071.001 | Web Protocols | Command and Control |
| T1105 | Ingress Tool Transfer | Command and Control |
| T1003.001 | LSASS Memory | Credential Access |
| T1003.003 | NTDS | Credential Access |
| T1110.001 | Password Guessing | Credential Access |
| T1027 | Obfuscated Files or Information | Defense Evasion |
| T1036.005 | Match Legitimate Name or Location | Defense Evasion |
| T1016 | System Network Configuration Discovery | Discovery |
| T1049 | System Network Connections Discovery | Discovery |
| T1135 | Network Share Discovery | Discovery |
| T1041 | Exfiltration Over C2 Channel | Exfiltration |
| T1485 | Data Destruction | Impact |
| T1486 | Data Encrypted for Impact | Impact |
| T1078 | Valid Accounts | Initial Access |
| T1189 | Drive-by Compromise | Initial Access |
| T1566.001 | Spearphishing Attachment | Initial Access |
| T1547.001 | Registry Run Keys | Persistence |
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
No YARA rules
No ransom notes