Cicada3301Malware
Last reported 8 months ago, by Group-IB4 reports
ATT&CK techniques
6 of 72 · each with the sentence it comes from- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1046Network Service Discovery
“T1046 Network Service Scanning”
- T1059Command and Scripting Interpreter
“T1059.001 Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001 Command and Scripting Interpreter: PowerShell”
- T1489Service Stop
“T1489 Service Stop”
- T1490Inhibit System Recovery
“T1490 Inhibit System Recovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“…ious research on ShadowSyndicate infrastructure, the following groups were not seen as a part of currently analyzed clusters: LockBit, Cicada3301, Quantum, Nokoyawa, Cactus and Play.”
-
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware“Please note that the commands related to modification of symLink evaluation behavior are also present in the BlackCat and Cicada3301 ransomware.”
-
Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group“Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group”
-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“A similar Rust-based ransomware called “Cicada3301” appeared six months after, which cybersecurity analysts suspect is BlackCat 2.0 operating under a new name.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
Copy this indicator · defanged
Thanks — we review every report.