NazarThreat actor
- sig37
This actor was identified by Juan Andres Guerrero-Saade from the SIG37 cluster as published in the ShadowBrokers' 'Lost in Translation' leak. Earliest known sighting potentially dates back to as far as 2008 with a confirmed center of activity around 2010-2013. The actor name is derived from a PDB debug string fragment: 'khzer'.From MISP Galaxy
Last reported 22 days ago, by Huntress1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1003.001LSASS Memory
“CISA's advisory documents Akira operators dumping credentials with Mimikatz and LaZagne, pulling them from LSASS memory, and running Kerberoasting against service accounts.”
- T1558.003Kerberoasting
“CISA's advisory documents Akira operators dumping credentials with Mimikatz and LaZagne, pulling them from LSASS memory, and running Kerberoasting against service accounts.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
The First 24 Hours: What Happens When Ransomware Lands“Nazar Tymoshyk founded UnderDefense in 2017 and leads it as CEO.”
Thanks — we review every report.