Risk Letters

Threat actor

Play

TLP:CLEAR

Facts

  • Motivation: Financial
  • Malware and tools: AdFind, BloodHound, Cobalt Strike, EDRKill (echo_driver.sys + DBUtil 2.3), Empire, FRP, GMER, HandleKatz, icardagt.exe (version.dll DLL sideload), IOBit, Mimikatz, Nanodump
  • Techniques (MITRE ATT&CK): Archive via Utility, Clear Windows Event Logs, Command Obfuscation, Data Transfer Size Limits, Disable or Modify Tools, Domain Accounts, Exfiltration Over Alternative Protocol, Exploit Public-Facing Application, External Remote Services, File and Directory Discovery, File Deletion, Financial Theft

Members get the actor's profile, its recent incidents and our assessment in the dashboard.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX.