Recent searches
Search options
Happy Friday to you all!
The Trend Micro researchers observed the #Kasseika ransomware leveraging the BYOVD (bring your own vulnerable driver) technique. They also analyzed the code and found that there was a lot in common with the #BlackMatter strain of ransomware as well, which would not be surprising, since these groups tend to help each other out, learn, and grow together to make the "best" malware that they can. Of course, they also witnessed some LOLBIN (living off the land binaries) abuse as well as a defense evasion technique used to kill antivirus services. There are plenty more details in the report, so I hope you enjoy! Happy Hunting!
Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver
https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html
Notable MITRE ATT&CK TTPs (Let me know which ones I missed!):
TA0002 - Execution
T1059.003 - Command and Scripting Interpreter: Windows Command Shell
TA0040 - Impact
T1490 - Inhibit System Recovery
TA0008 - Lateral Movement
T1021.002 - Remote Services: SMB/Windows Admins Shares
TA0005 - Defense Evasion
T1562.001 - Impair Defenses: Disable or Modify Tools