Patchfirst

How Groove Gang is shaking up the Ransomware-as-a-Service market to empower affiliates

Intel 471 · 9 Sep 2021 · github.com · Licence: CC-BY-SA-4.0; sources/annoctr/LICENSE.txt

Read the original ↗

CVEs this report names

1 CVE
  1. CVE-2017-0144Microsoft SMBv1 Remote Code Execution Vulnerability
    Microsoft · SMBv1KEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services3 reports
    99.2%Top 0.06%
    86.9priority

Where it names them

CVE-2017-0144
Brute forcing RDP accounts, the dumping of credentials, and the use of *legacy* exploits such as EternalBlue (CVE-2017-0144), are ways to quickly obtain access to one or more privileged accounts.
Original (opens in a new tab) ↗

Techniques drawn from this report

3 links, in kill-chain order

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2017-0144

Labelled by dataset annotators

Brute forcing RDP accounts, the dumping of credentials, and the use of *legacy* exploits such as EternalBlue (CVE-2017-0144), are ways to quickly obtain access to one or more privileged accounts.
Original (opens in a new tab) ↗

Credential Access OS Credential Dumping T1003 for CVE-2017-0144

Labelled by dataset annotators

Brute forcing RDP accounts, the dumping of credentials, and the use of *legacy* exploits such as EternalBlue (CVE-2017-0144), are ways to quickly obtain access to one or more privileged accounts.
Original (opens in a new tab) ↗

Credential Access Brute Force T1110 for CVE-2017-0144

Labelled by dataset annotators

Brute forcing RDP accounts, the dumping of credentials, and the use of *legacy* exploits such as EternalBlue (CVE-2017-0144), are ways to quickly obtain access to one or more privileged accounts.
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close