GotchaMalware
ransomwareFrom MISP Galaxy
Last reported 5 months ago, by Huntress1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1003.006DCSync
“Figure 11: The hash from the dMSA flow (bdfb66498271947e40b00394086dbc76) matches what DCSync returns for svc-ouroboros.”
- T1110Brute Force
“Offline password brute-force (1,024 combinations)”
- T1558.003Kerberoasting
“Every DACL-based attack path that BloodHound identifies -- Shadow Credentials, RBCD, Targeted Kerberoasting, Constrained Delegation abuse, noPac, Certifried -- requires the same GenericWrite or CreateChild prerequisite that is being cited here as disqualifying.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025“The SDDL Gotcha: The SDDL must use expanded specific rights (CCDCLCSWRPWPDTLOCRSDRCWDWO), NOT the Generic All shorthand (GA).”
Indicators in its reports
named in the reports above- bdfb66498271947e40b00394086dbc76in 1 report
- 0dd62b698ae591f86e6a40d73420820ain 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.