ShadowSyndicateThreat actor
ShadowSyndicate is a threat actor associated with various ransomware groups, using a consistent Secure Shell fingerprint across multiple servers. They have been linked to ransomware families such as Quantum, Nokoyawa, and ALPHV. ShadowSyndicate's infrastructure overlaps with that of Cl0p, suggesting potential connections between the two groups.From MISP Galaxy
Last reported 8 months ago, by Group-IB4 reports
ATT&CK techniques
6 of 30 · each with the sentence it comes from- T1001Data Obfuscation
“T1001 – Data Obfuscation”
- T1005Data from Local System
“T1005 – Data from Local System”
- T1041Exfiltration Over C2 Channel
“T1041 – Exfiltration Over C2 Channel”
- T1056Input Capture
“T1056 – Input Capture”
- T1056.001Keylogging
“T1056.001 – Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“T1059.007 – Command and Scripting Interpreter: JavaScript”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure”
-
Boolka Unveiled: From web attacks to modular malware“In January 2024, during the analysis of the infrastructure used by ShadowSyndicate Group-IB Threat Intelligence analysts detected a landing page designed to distribute the BMANAGER modular trojan, created by threat actor dubbed Boolka.”
-
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware“… develop ransomware and manage the RaaS programs before launching their own RaaS program based on Nokoyawa ransomware (also used by ShadowSyndicate).”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“Dusting for fingerprints: ShadowSyndicate, a new RaaS player?”
Indicators in its reports
named in the reports above- 1ca4cbac895fc3bd12417b77fc6ed31din 2 reports
- exploit[.]inin 1 report
- anbush[.]comin 1 report
- mysqlserver[.]orgin 1 report
- ipulsecloud[.]comin 1 report
- esoftwareupdates[.]comin 1 report
- cmdatabase[.]comin 1 report
- maximumservers[.]netin 1 report
- avdev[.]netin 1 report
- devcloudpro[.]comin 1 report
- uranustechsolution[.]comin 1 report
- qw.sveexec[.]comin 1 report
- situotech[.]comin 1 report
- 194.165.16[.]64in 1 report
- 46.161.27[.]151in 1 report
- 193.142.30[.]37in 1 report
- 193.142.30[.]205in 1 report
- 81.19.135[.]229in 1 report
- 194.165.16[.]53in 1 report
- 5.188.87[.]47in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.