BlackoutMalware
RansomwareFrom MISP Galaxy
Last reported 9 days ago, by Silent Push3 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1684Social Engineering
“Barracuda said it analyzed a campaign that combined traditional social engineering, such as password-protected attachments, with prompt injection hidden in the same message.”
- T1055Process Injection
“…teRemoteThread." The malware can collect system metadata, enable interactive shell access, terminate security processes, implement process injection techniques, replace clipboard text, enumerate local accounts, and terminate itself.”
- T1195Supply Chain Compromise
“A compromised supplier may expose customer identities and trusted administrative paths, but it’s only a software supply-chain compromise if there is evidence that downstream customers, builds, updates, or distribution were affected.”
- T1218.002Control Panel
“The same IP also presents painel.installscenter.com on ports 8083 and 8443, so a control panel hostname and the C2 hostname sit on the same apex and the same host."”
- T1505.003Web Shell
“File upload flaw enables web shells”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
A Global Public-Private Partnership Just Got Preemptive“That principle drove Silent Push’s role in Joint Disruption Week, a coordinated international operation called Operation Blackout, aimed at criminal scam networks operating out of West Africa.”
-
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories“FBI Director Kash Patel has revealed that Operation Blackout has seized $17 billion, arrested hundreds, and freed thousands of trafficked workers, as law enforcement continues its effort to combat scam compounds that prey on the elderly by tricking them into investing their funds…”
-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“The Blackout Is Both A Collection Gap And An Attack Surface”
Indicators in its reports
named in the reports above- hunt[.]ioin 1 report
- c2.installscenter[.]comin 1 report
- painel.installscenter[.]comin 1 report
- 80.78.27[.]252in 1 report
- 45.138.12[.]177in 1 report
- 151.243.232[.]123in 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.