DharmaMalware
- ncov
- wadhrama
According to MalwareBytes, the Dharma Ransomware family is installed manually by attackers hacking into computers over Remote Desktop Protocol Services (RDP). The attackers will scan the Internet for computers running RDP, usually on TCP port 3389, and then attempt to brute force the password for the computer.From MISP Galaxy
Last reported 5 days ago, by Krebs on Security2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1110Brute Force
“…ss or first signs of observed malicious activity—whether that’s through unauthorized account access via stolen credentials or through brute force attacks on Remote Desktop (RDP)”
- T1550.002Pass the Hash
“When this mode is disabled, it could be indicative of a pass-the-hash attack, where threat actors steal hashed versions of user credentials and use them to make new sessions on the same network.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site“In 2018, a Canadian company was hacked by Dharma, a prolific Russian-language ransomware affiliate program that first surfaced in 2016.”
-
Time to Ransom is Money“We saw faster deployment times from some threat actors, including Play, Akira, and Dharma/Crysis, and longer times from others, including (ironically) Rapid, Sodinokibi, and Phobos.”
Indicators in its reports
named in the reports above- shinywire[.]comin 1 report
- tutanota[.]comin 1 report
- tuta[.]ioin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.