Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
The Gentlemen Ransomware Affiliate Deploys EtherRAT via Ethereum Smart Contract C2
Malware Families
Excerpt
An exposed directory on 193.233.202[.]17 has revealed a detailed intrusion toolkit linked to a suspected affiliate of The Gentlemen ransomware operation. The recovered files show an operator preparing to gain long-term access to Windows networks, steal credentials, disable security products, move across the domain, and deploy several command-and-control (C2) channels. The directory contained 82 files totaling about 145 MB. Researchers recovered 37 Windows executables, 22…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(4)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | resumeacceptable.com | High | Score 58/100 | First seen |
| IP | 193.233.202.17 | High | Score 58/100 | First seen |
| Domain | publisherresolution.com | High | Score 58/100 | First seen |
| Domain | wiselystarting.com | High | Score 86/100 | First seen |
| Domain | itemrange.com | High | Score 86/100 | First seen |
| Domain | simultaneouslypower.com | High | Score 86/100 | First seen |
| SHA1 | b3f2897f2bc797e5b9033faef8c81e92b01cb831 | Medium | Score 53/100 | First seen |
| IP | 77.110.122.137 | Medium | Score 55/100 | First seen |
IOC Relationship Graph
Building graph…