Tag: sentinelone impersonation

1 Attack Reports | 0 Vulnerabilities

Attack reports

Play Ransomware impersonates SentinelOne for stealth recon

A Play ransomware attack involving a reconnaissance tool called Grixba was detected and prevented. The attack began with the deployment of Grixba via RDP to a Windows server. The Grixba file was disguised as legitimate SentinelOne software, a new tactic for the group. Grixba is an obfuscated .NET-b…
obfuscation
ransomware
.net
rdp
reconnaissance
grixba
play
2025-01-17
sentinelone impersonation
xor encryption
Published: January 17, 2025
Downloadable IOCs: 4
Click here to see more Attack Reports