dearcryMalware
- doejocrypt
According to PCrisk, DearCry ransomware has been observed infecting systems via ProxyLogon vulnerabilities of Microsoft Exchange servers - mail and calendaring servers developed by Microsoft. While a patch has been released addressing these vulnerabilities, thousands of Microsoft Exchange servers remained unpatched at the time of research.From MISP Galaxy
Last reported 3 months ago, by Huntress1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1036Masquerading
“The River City Media data leak involved a spam operation, where the spam email operators were masquerading as a legitimate email marketing firm.”
- T1110Brute Force
“The hack was not a traditional brute force attack but rather an inside job that took advantage of a security weakness in the cloud environment.”
- T1110.004Credential Stuffing
“…had reused common passwords on other websites were put at risk of having those accounts compromised as well, leading to a wave of credential stuffing attacks after the data became public.”
- T1505.003Web Shell
“The breach was particularly bad because the attackers installed web shells and backdoors on the compromised servers, allowing them to maintain long-term access even after Microsoft released patches.”
- T1684Social Engineering
“The information could be used in highly convincing and targeted social engineering attacks, phishing scams, and identity theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
27 Biggest Data Breaches in History: Famous Examples“…cluded mailbox contents and other sensitive information, which was used for cyber espionage, crypto-mining, and ransomware attacks like DearCry.”
Indicators in its reports
named in the reports above- securitydiscovery[.]comin 1 report
Copy this indicator · defanged
Thanks — we review every report.