TheDarkOverlordThreat actor
The Dark Overlord is a financially motivated ransomware group that has been active since 2016. The group is known for targeting large organizations, including Netflix, ABC, and Miramax.From MISP Galaxy
Last reported 20 days ago, by The Hacker News2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1684Social Engineering
“…group and challenge claims made by the agency about its connections with The Com, a loose-knit cybercrime collective notorious for social engineering, phishing, SIM swapping, extortion, sextortion, swatting, kidnapping, and physical violence.”
- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1110.004Credential Stuffing
“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
- T1550.002Pass the Hash
“Lateral movement was achieved mostly through RDP with compromised credentials, though other attacks like Pass-the-Hash were also observed.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members“…actical evolution, cybersecurity companies Sekoia and Beazley Security said its lineage goes back to two progenitor hacking groups, TheDarkOverlord and GnosticPlayers, that specialized in extortion and data leak operations.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“ShinyHunters' lineage traces back through two earlier hacking collectives, TheDarkOverlord and GnosticPlayers, in a chain researchers describe as sharing continuity of personnel rather than just similarity of style.”
Indicators in its reports
named in the reports above- security[.]orgin 1 report
- apply.fbijobs[.]govin 1 report
- azurenetfiles[.]netin 1 report
- 142.11.200[.]186in 1 report
- politie[.]nlin 1 report
- secure[.]comin 1 report
- promo[.]comin 1 report
- raidforums[.]comin 1 report
- rf[.]wsin 1 report
- raid[.]lolin 1 report
- breachforums[.]stin 1 report
- breachforums[.]hnin 1 report
- task[.]namein 1 report
- fa210f015399de16…94972a3bdc43in 1 report
- d5efdf6f35e9c6ed…3d591b94e384in 1 report
- a4e525d8825c1bac…799e07e207e4in 1 report
- classaction[.]orgin 1 report
- w[.]mediain 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.