Globe v1Malware
- Purge
RansomwareFrom MISP Galaxy
Last reported 10 days ago, by Group-IB4 reports
ATT&CK techniques
6 of 61 · each with the sentence it comes from- T1036Masquerading
“Masquerading [T1036]”
- T1684Social Engineering
“This technique is not only a simple re-execution detection mechanism, but also a social engineering trick that deceives users into thinking something went wrong with the execution.”
- T1010Application Window Discovery
“…(T1057), Software (T1518), Query Registry (T1012), System Owner/User (T1033), System Location (T1614/.001), Account (T1087), App Window (T1010), File & Directory (T1083)”
- T1012Query Registry
“System Info (T1082), Process (T1057), Software (T1518), Query Registry (T1012), System Owner/User (T1033), System Location (T1614/.001), Account (T1087), App Window (T1010), File & Directory (T1083)”
- T1014Rootkit
“…nctionality includes registry editing, process and service management, UAC bypass and privilege escalation, persistence mechanisms, and rootkit capabilities, all wrapped in stealth features designed to minimize the malware’s footprint.”
- T1016System Network Configuration Discovery
“System Network Configuration Discovery [T1016]”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize“Persistence Purge: Scans the Windows Registry (Run and RunOnce keys) and the Startup folder to delete any entry that allows a rival program to restart after a reboot.”
-
Protecting organizations from AI-assisted executive impersonation and invoice fraud“…ery; messages later determined to be malicious can be quarantined or removed through post-delivery remediation, including Zero-hour Auto Purge.”
-
Your AI Stack Just Handed Over Your Root Keys: Inside the litellm PyPI Breach“Purge the environment.”
-
Rapid Response: Mass MSP Ransomware Incident“Additional procedures were "Archive and Purge Logs"”
Indicators in its reports
named in the reports above- service-nowinc[.]comin 1 report
- domainlify[.]netin 1 report
- uinsure.co[.]ukin 1 report
- tivityhealth[.]comin 1 report
- lumalisboa[.]comin 1 report
- mctci[.]comin 1 report
- nuf.co[.]jpin 1 report
- lohnsteuerhilfe-aktuell-verein[.]dein 1 report
- tovimbatista[.]ptin 1 report
- eemusicclass.co[.]ukin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.