Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Excerpt
_Overview AveMariaRAT, also known as WarZoneRAT, is one of the most famous and widely used RATs in recent years. It can be purchased with a license and monthly subscriptions ranging from $16 to $38 on its website. This tool is used and modified by various groups, ranging from disorganized or resource-limited individuals known as script kiddies to highly relevant criminal groups or APTs. Some of the notable groups that have been observed using AveMariaRAT include: Tomiris ( 🏴…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | 206.225.104146.70.94.395.214.27.90161.129.33.242173.212.207.73104.223.19.96warzonlicen1304.ddns.netdreams2reality.duckdns.orggbotowaya.duckdns.orghelpme20.duckdns.orgnewnex.3utilities.comzpec.ruosairus.duckdns.orglacasadelpan2024.duckdns.org | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…