Tag: lockbit 3.0

4 Attack Reports | 0 Vulnerabilities

Attack reports

Head Mare and Twelve: Joint attacks on Russian entities

Head Mare and Twelve, two hacktivist groups, have launched joint attacks on Russian companies. Head Mare has expanded its toolkit, now using tools previously associated only with Twelve, such as the CobInt backdoor. The attackers gained initial access through phishing emails and compromised contrac…

infrastructure sharing

Published: March 13, 2025

Downloadable IOCs: 0

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

A Chinese hacking group called 'You Dun' was discovered through an exposed open directory, revealing their comprehensive attack infrastructure. The group utilized sophisticated reconnaissance tools and exploited Zhiyuan OA software via SQL injection attacks, targeting South Korean pharmaceutical or…

privilege escalation

c2 infrastructure

chinese hackers

viper framework

reconnaissance tools

Published: October 28, 2024

Linked vulnerabilities : CVE-2021-25003

Downloadable IOCs: 7

Analyzing the familiar tools used by the Crypt Ghouls hacktivists

The Crypt Ghouls group is targeting Russian businesses and government agencies with ransomware attacks. They utilize a toolkit including utilities like Mimikatz, XenAllPasswordPro, PingCastle, and others. The group employs LockBit 3.0 and Babuk ransomware as final payloads. Initial access is often …

credential harvesting

lateral movement

xenallpasswordpro

Published: October 18, 2024

Downloadable IOCs: 1

From initial compromise to ransomware and wipers

The Twelve group, formed in April 2023 amid the Russian-Ukrainian conflict, specializes in attacking Russian government organizations. Their attacks involve encrypting and deleting victims' data, causing maximum damage without seeking financial gain. The group uses publicly available tools like Cob…

Published: September 23, 2024

Linked vulnerabilities : CVE-2021-22005, CVE-2021-21972

Downloadable IOCs: 20

Click here to see more Attack Reports