EgregorMalware

“It was used by the threat actors to modify registry and firewall rules to enable connections via Remote Desktop Protocol.”

“Failed user login event (brute-force)”

“In addition, they used Rclone for data exfiltration – the same masquerading technique was used, they renamed its binary to svchost.exe and placed it to C:Windows.”

“Usually the threat actors try to deploy ransomware as widely as possible, and use PsExec or Group Policy modification to run a scheduled task to run it.”

“failed user login – credential access (password guessing) user creation event – persistence”

“It’s important to note that the RaaS affiliates rarely perform brute force or password spraying attacks against such instances themselves, rather they buy accesses from the brokers.”