SecuriTricks - lockbit

Unmasking SocGholish: Untangling the Malware Web Behind the 'Pioneer of Fake Updates' and Its Operator

SocGholish, operated by TA569, functions as a Malware-as-a-Service vendor, employing deceptive 'fake browser update' lures to compromise systems. It leverages Traffic Distribution Systems like Parrot TDS and Keitaro TDS to filter and redirect victims. TA569 acts as an Initial Access Broker, enablin…

ransomware

lockbit

socgholish

malware-as-a-service

initial access broker

traffic distribution system

domain shadowing

hades

Published: August 8, 2025

Downloadable IOCs: 33

Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks

Unit 42 has identified significant overlaps between Microsoft's reported ToolShell activity and a threat cluster they track as CL-CRI-1040. This cluster utilizes a tool set called Project AK47, which includes a multi-protocol backdoor, custom ransomware, and loaders. The activity is linked to the e…

Published: August 6, 2025

Linked vulnerabilities : CVE-2024-1182 (CVSS 7.0), CVE-2024-7587 (CVSS 7.8), CVE-2024-8299 (CVSS 7.8), CVE-2025-0282 (CVSS 9.0), CVE-2025-0283 (CVSS 7.0), CVE-2024-53870 (CVSS 3.3), CVE-2025-31324 (CVSS 10.0), CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 27

Exploring Storm-2603's Previous Ransomware Operations

A focused analysis of Storm-2603, a threat actor linked to recent ToolShell exploitations alongside other Chinese APT groups, reveals their use of a custom malware C2 framework called 'ak47c2'. This framework includes HTTP and DNS-based clients. The group likely targeted organizations in Latin Amer…

Published: August 1, 2025

Linked vulnerabilities : CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 25

Unmasking LockBit: A Deep Dive into DLL Sideloading and Masquerading Tactics

This analysis explores the sophisticated tactics employed by LockBit ransomware attackers, focusing on DLL sideloading and masquerading techniques. These methods allow attackers to evade detection and maximize impact. DLL sideloading involves tricking legitimate applications into loading malicious …

Published: August 1, 2025

Downloadable IOCs: 11

May 2025 Security Issues in Korean & Global Financial Sector

This comprehensive analysis covers cyber threats targeting financial companies in Korea and globally. It examines malware and phishing cases, top 10 malware strains, and statistics on leaked Korean accounts. The report delves into major financial threats on the dark web, including credit card data …

Published: June 13, 2025

Downloadable IOCs: 0

Danabot: Analyzing a fallen empire

ESET Research shares insights into Danabot, an infostealer recently disrupted by law enforcement. The malware, tracked since 2018, evolved from a banking trojan to a versatile tool for data theft and malware distribution. Operated as a malware-as-a-service, Danabot offered features like data steali…

Published: May 25, 2025

Downloadable IOCs: 1

Unfiltered look into LockBit’s operations

A breach of LockBit's dark web affiliate panels exposed a rare glimpse into their operations. The leaked data included Bitcoin addresses, admin credentials, and a chat log revealing negotiation tactics and ransom demands. Ransom amounts varied widely, with some victims confused about the demands. T…

ransomware

lockbit

data breach

initial access brokers

Published: May 15, 2025

Downloadable IOCs: 3

New Ransomware Operator Exploits Fortinet Vulnerability Duo

A new ransomware operator, dubbed Mora_001, has been exploiting Fortinet firewall vulnerabilities CVE-2024-55591 and CVE-2025-24472 to gain unauthorized access and deploy a modified version of LockBit ransomware. The threat actor creates persistent admin accounts, exfiltrates firewall configuration…

Published: March 14, 2025

Downloadable IOCs: 23

Head Mare and Twelve: Joint attacks on Russian entities

Head Mare and Twelve, two hacktivist groups, have launched joint attacks on Russian companies. Head Mare has expanded its toolkit, now using tools previously associated only with Twelve, such as the CobInt backdoor. The attackers gained initial access through phishing emails and compromised contrac…

infrastructure sharing

2025-03-13

phantomjitter

Published: March 13, 2025

Downloadable IOCs: 0

Confluence Exploit Leads to LockBit Ransomware

An intrusion began with the exploitation of CVE-2023-22527 on an exposed Windows Confluence server, leading to LockBit ransomware deployment across the environment. The threat actor utilized various tools including Mimikatz, Metasploit, and AnyDesk. They leveraged RDP for lateral movement and deplo…

Published: February 24, 2025

Linked vulnerabilities : CVE-2017-0199, CVE-2023-22515, CVE-2023-22527, CVE-2023-22518

Downloadable IOCs: 15

Phorpiex - Downloader Delivering Ransomware

The report analyzes the Phorpiex botnet's role in delivering LockBit Black Ransomware. It highlights the automated execution of ransomware through Phorpiex, minimal changes to the botnet's code since its source code sale in 2021, and direct deployment of LockBit without network expansion. The analy…

Published: January 29, 2025

Downloadable IOCs: 14

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

This report details an intrusion that began with the execution of a Cobalt Strike beacon masquerading as a Windows Media Configuration Utility. The threat actor used various tools for persistence, lateral movement, and data exfiltration, including SystemBC and GhostSOCKS proxies, Rclone, and PsExec…

Published: January 27, 2025

Downloadable IOCs: 21

Hacktivists attack Russian organizations using rare RATs

The Cyber Anarchy Squad (C.A.S) is a hacktivist group targeting Russian and Belarusian organizations since 2022. They exploit vulnerabilities in public services and use free tools to inflict maximum damage. The group employs rare remote access Trojans like Revenge RAT and Spark RAT, alongside commo…

Published: December 18, 2024

Downloadable IOCs: 0

Intensifies Attacks On Russia With PhantomCore

The Head Mare hacktivist group has escalated its campaign against Russian targets using the PhantomCore backdoor. The group employs deceptive ZIP archives containing malicious LNK files and executables disguised as archive files to deploy PhantomCore. This C++-compiled backdoor, which replaces earl…

Published: December 11, 2024

Linked vulnerabilities : CVE-2023-38831

Downloadable IOCs: 31

The State of Cloud Ransomware in 2024

Cloud ransomware attacks are evolving, primarily targeting storage services like Amazon S3 and Azure Blob Storage. Attackers exploit misconfigurations or use stolen credentials to access and encrypt data. Cloud service providers have implemented security measures, such as AWS's 7-day key deletion w…

web application attacks

identity management

kms

Published: November 14, 2024

Downloadable IOCs: 0

Inside the Open Directory of the “You Dun” Threat Group

An open directory exposed a Chinese-speaking threat actor's toolkit and operational history. The actor conducted extensive scanning and exploitation targeting organizations in South Korea, China, Thailand, Taiwan, and Iran using tools like WebLogicScan, Vulmap, and Xray. The Viper C2 framework and …

weblogic exploitation

viper c2

chinese threat actor

Published: October 28, 2024

Downloadable IOCs: 3

Analyzing the familiar tools used by the Crypt Ghouls hacktivists

The Crypt Ghouls group is targeting Russian businesses and government agencies with ransomware attacks. They utilize a toolkit including utilities like Mimikatz, XenAllPasswordPro, PingCastle, and others. The group employs LockBit 3.0 and Babuk ransomware as final payloads. Initial access is often …

credential harvesting

Published: October 18, 2024

Downloadable IOCs: 1

Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA

A zero-day vulnerability exploited by an advanced adversary to gain access to a victim’s network, according to research by FortiGuard Labs and the Centre for Strategic Intelligence (CISA).

zero-day vulnerability

Published: October 15, 2024

Downloadable IOCs: 17

Analyzing Recent Cyber Attacks in the United States Coinciding with Columbus Day Celebration

The United States has experienced a significant increase in cyber attacks from June to October 2024, with over 800 organizations affected by ransomware across various sectors. Play, RansomHub, Lockbit, Qilin, and Meow have emerged as the most active ransomware groups. Notable incidents include the …

critical infrastructure

united states

Published: October 10, 2024

Downloadable IOCs: 0

Analysis of the BlackJack group: techniques, tools, and similarities with Twelve

The report examines the BlackJack hacktivist group targeting Russian organizations, focusing on their tools, techniques, and connections to the Twelve group. BlackJack employs freely available software like the Shamoon wiper and LockBit ransomware. Significant overlaps with Twelve include similar m…

Published: September 25, 2024

Downloadable IOCs: 1

Head Mare: adventures of a unicorn in Russia and Belarus

Head Mare is a hacktivist group targeting companies in Russia and Belarus since 2023. They use phishing campaigns exploiting the CVE-2023-38831 vulnerability in WinRAR for initial access. Their toolkit includes custom malware like PhantomDL and PhantomCore, as well as publicly available tools like …

Published: September 2, 2024

Linked vulnerabilities : CVE-2023-38831

Downloadable IOCs: 52

DeathGrip RaaS | Small-Time Threat Actors Aim High With LockBit & Yashma Builders

This analysis examines the emergence of DeathGrip, a Ransomware-as-a-Service (RaaS) operation that provides threat actors with easy access to sophisticated ransomware builders like LockBit 3.0 and Yashma/Chaos. The accessibility of these tools enables even those with minimal technical skills to lau…

Published: August 9, 2024

Downloadable IOCs: 1

Threat Actor Masquerades as Hacktivist Group Rebelling Against AI

SentinelLabs identified a cybercriminal group, NullBulge, targeting AI- and gaming-focused entities. The group injects malware into public code repositories and gaming mods, leading victims to import malicious libraries. NullBulge uses tools like Async RAT and Xworm before delivering customized Loc…

Published: July 16, 2024

Downloadable IOCs: 9

Ransomware: Activity Levels Remain High Despite Disruption

While overall activity levels dipped slightly in the first quarter of 2024, the number of claimed attacks remained high, with LockBit accounting for over 20%. The report explores the changing tactics employed by ransomware actors, including the exploitation of vulnerabilities, the use of Bring-Your…

Published: July 11, 2024

Linked vulnerabilities : CVE-2024-4577 (CVSS 9.8)

Downloadable IOCs: 27

Decrypted: DoNex Ransomware and its Predecessors

Researchers have uncovered a cryptographic flaw in the DoNex ransomware and its previous iterations, allowing for the creation of a decryptor tool. Initially discovered in March 2024, this cryptographic weakness was made public at Recon 2024. The ransomware, which has undergone several rebrands sin…

Published: July 10, 2024

Downloadable IOCs: 8

TargetCompany’s Linux Variant Targets ESXi Environments

Since its discovery in 2021, TargetCompany has been evolving its techniques to circumvent security defenses employed by organizations; one such technique its use of a PowerShell script to bypass Antimalware Scan Interface (AMSI) and abuse of fully undetectable (FUD) obfuscator packers. A new varian…

Published: June 6, 2024

Downloadable IOCs: 3

Ikaruz Red Team | Hacktivist Group Leverages Ransomware for Attention Not Profit

SentinelOne is the world's leading provider of self-defence and cybersecurity, with a platform powered by artificial intelligence and the power of the Singularity XDR, which aims to protect and respond to cyber attacks at scale.

Published: May 21, 2024

Downloadable IOCs: 1

Security Brief: Millions of Messages Distribute LockBit Black Ransomware

In late April 2024, Proofpoint observed high-volume email campaigns facilitated by the Phorpiex botnet, distributing millions of messages with attachments leading to LockBit Black ransomware infections. The messages appeared to originate from 'Jenny Green' and contained ZIP attachments with executa…

Published: May 13, 2024

Downloadable IOCs: 16

Tag: lockbit

Attack reports

GOLD SALEM tradecraft for deploying Warlock ransomware

Dragons in Thunder

Major October 2025 Cyber Attacks Your SOC Can't Ignore

Warlock Ransomware: Old Actor, New Tricks?

Velociraptor leveraged in ransomware attacks

From SharePoint Vulnerability Exploit to Enterprise Ransomware

Unmasking SocGholish: Untangling the Malware Web Behind the 'Pioneer of Fake Updates' and Its Operator

Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks

Exploring Storm-2603's Previous Ransomware Operations

Unmasking LockBit: A Deep Dive into DLL Sideloading and Masquerading Tactics

May 2025 Security Issues in Korean & Global Financial Sector

Danabot: Analyzing a fallen empire

Unfiltered look into LockBit’s operations

New Ransomware Operator Exploits Fortinet Vulnerability Duo

Head Mare and Twelve: Joint attacks on Russian entities

Confluence Exploit Leads to LockBit Ransomware

Phorpiex - Downloader Delivering Ransomware

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

Hacktivists attack Russian organizations using rare RATs

Intensifies Attacks On Russia With PhantomCore

The State of Cloud Ransomware in 2024

Inside the Open Directory of the “You Dun” Threat Group

Analyzing the familiar tools used by the Crypt Ghouls hacktivists

Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA

Analyzing Recent Cyber Attacks in the United States Coinciding with Columbus Day Celebration

Analysis of the BlackJack group: techniques, tools, and similarities with Twelve

Head Mare: adventures of a unicorn in Russia and Belarus

DeathGrip RaaS | Small-Time Threat Actors Aim High With LockBit & Yashma Builders

Threat Actor Masquerades as Hacktivist Group Rebelling Against AI

Ransomware: Activity Levels Remain High Despite Disruption

Decrypted: DoNex Ransomware and its Predecessors

TargetCompany’s Linux Variant Targets ESXi Environments

Ikaruz Red Team | Hacktivist Group Leverages Ransomware for Attention Not Profit

Security Brief: Millions of Messages Distribute LockBit Black Ransomware