Microsoft MSHTML bug Exploited for Credential Theft – Active IoCs
November 25, 2021Rewterz Threat Update – Behind the Rise of the Million Dollar Zero-Day Market
November 25, 2021Microsoft MSHTML bug Exploited for Credential Theft – Active IoCs
November 25, 2021Rewterz Threat Update – Behind the Rise of the Million Dollar Zero-Day Market
November 25, 2021Severity
Medium
Analysis Summary
The Thanos ransomware was first discussed by Recorded Future in February 2020 when it was advertised for sale on underground forums. The Thanos ransomware has a builder that allows actors to customize the sample with a variety of available settings. The fact Thanos is for sale suggests the likelihood of multiple threat actors using this ransomware. However, we believe with high confidence that the same actor used a Thanos variant in attacks on two state-run organizations in the Middle East and North Africa. The Thanos variant created a text file that displayed a ransom message requesting the victim to transfer “20,000$” into a specified Bitcoin wallet to restore the files on the system. Below is the ransom note found on encrypted machines.
Impact
- Files Encryption
Indicators of Compromise
MD5
- 54e8989f3595120a430b8d31ca87c0cc
- 6ee908f96417fb283e6f20f133a0e478
SHA-256
- 74a717027b6212236662bf641c473b8f8cd65486898b02940357bb9b3035f38a
- ce686daaf9d97fb2c42d9789d19f1dbdb81d1b45851cf3d9e67f46b578365764
SHA-1
- 30609e95e4396e7c409b21e0d96c185736cc01d2
- 220d48d43f57951ec8cdb0e0cd348e7d1848eef7
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.