Rewterz Threat Alert – APT Group Gamaredon – Active IOCs
March 21, 2022Rewterz Threat Alert – Nanocore Rat – Active IOCs
March 21, 2022Rewterz Threat Alert – APT Group Gamaredon – Active IOCs
March 21, 2022Rewterz Threat Alert – Nanocore Rat – Active IOCs
March 21, 2022Severity
High
Analysis Summary
Hive ransomware, which was first observed in June 2021 and likely operates as an affiliate-based ransomware, employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Hive ransomware uses multiple mechanisms to compromise business networks, including phishing emails with malicious attachments to gain access and Remote Desktop Protocol (RDP) to move laterally once on the network. After compromising a victim network, Hive ransomware actors exfiltrate data and encrypt files on the network. The actors leave a ransom note in each affected directory within a victim’s system, which provides instructions on how to purchase the decryption software. The ransom note also threatens to leak exfiltrated victim data on the Tor site, “HiveLeaks.”
Impact
- Unauthorized Access
- Data Exfiltration
- File Encryption
Indicators of Compromise
MD5
- 8a1483560ba30a228a894fccf480d5ab
- 3aeb1e332f41370b3490bfb07e488ddf
- eb45ff7ea2ccdcceb2e7e14f9cc01397
- 8240d60d83cb7c0248e64389855e29b4
- 504bd1695de326bc533fde29b8a69319
- e3798c3bea835b99e994956acf3b942c
SHA-256
- fd3e7d0f6a31b821604707ef99da281e4fd7d11c7804e46eeed11f66b200a391
- 3ec89b737c5b91eb9da0a2d9c6c1f0e637087b4552e26806d959c11f8f06e96f
- 1e21c8e27a97de1796ca47a9613477cf7aec335a783469c5ca3a09d4f07db0ff
- fdbc66ebe7af710e15946e1541e2e81ddfd62aa3b35339288a9a244fb56a74cf
- a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749
- 5954558d43884da2c7902ddf89c0cf7cd5bf162d6feefe5ce7d15b16767a27e5
SHA-1
- dfa03ab86ea14f289c2be215acd739315f0591b5
- 3d2b76ecec89e8f2b0c2b0fc79653a60082ee2f1
- 2f3273e5b6739b844fe33f7310476afb971956dd
- 3b40dbdc418d2d5de5f552a054a32bfbac18c5cc
- 67f0c8d81aefcfc5943b31d695972194ac15e9f2
- ca247833b60a6043c6361e5772e1e6acf848de5d
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.