Rewterz Threat Advisory –RealTek CVE-2021-35394 Exploited in the Wild
August 31, 2021Rewterz Threat Alert –HawkEye Infostealer – Active IOCs
August 31, 2021Rewterz Threat Advisory –RealTek CVE-2021-35394 Exploited in the Wild
August 31, 2021Rewterz Threat Alert –HawkEye Infostealer – Active IOCs
August 31, 2021Severity
High
Analysis Summary
Phobos ransomware appeared at the beginning of 2019. It has been noted that this new strain of ransomware is strongly based on the previously known family: Dharma (a.k.a. Crysis), and probably distributed by the same group as Dharma. Phobos is one of the ransomware that is distributed via hacked Remote Desktop (RDP) connections. This isn’t surprising, as hacked RDP servers are a cheap commodity on the underground market, and can make for an attractive and cost-efficient dissemination vector for threat groups. This ransomware does not deploy any techniques of UAC bypass. When we try to run it manually, the UAC confirmation pops up:
Impact
- File Encryption
Indicators of Compromise
MD5
- 714ab7180c383030e5504e624b07e9a8
SHA-256
- 25e3689f86ed1836778f07977f0d4b491b8d6976218a4d9c3f4c45257d8a7004
SHA-1
- 649a4a6072800dbadf64250d61026e808c9f3cf9
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.