Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Ransomware Hackers Disable Security Tools and Backups Before Encrypting Entire Networks
Malware Families
Excerpt
Researchers have uncovered a fast and highly destructive ransomware playbook used by The Gentlemen ransomware-as-a-service (RaaS) operation. The group, tracked as GOLD SHERWOOD, steals data, disables security tools and backup services, then encrypts systems across victim networks. The attacks can move from initial access to ransomware deployment in less than 24 hours. Researchers found a median time of about two days between the first post-compromise activity and encryption.…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 622b2ca08552535bc142cb815ff9ec16 | Medium | Score 53/100 | First seen |
| SHA1 | f0bc50d2d2838c5294e21cd9bce2f09bf581e508 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…