HitlerMalware
Ransomware Deletes filesFrom MISP Galaxy
Last reported 3 days ago, by Risky Business News3 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1552.004Private Keys
“…Mudhra certs: Mozilla has removed the eMuhdra root certificate from Firefox after eight of the company's intermediary certs had their private keys compromised.”
- T1553.002Code Signing
“Six of the eight are for issuing TLS certificates, while the other two are for code-signing and trusted only by Microsoft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“…s into handbags and boots, discussions of whether refugees should be shot at the border, a Christmas card sent with a swastika and “Heil Hitler…”””
-
AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive“…g to the summaries ICD relayed, Gauland, the party’s 85-year-old honorary chairman and former co-leader, forwarded a 2018 email about a “Hitler pilgrimage” by a former judge on the party’s internal court in Thuringia.” AfD told told Bild.”
-
Hacktivists unmasked“He also uses photos depicting Adolf Hitler on his Deface pages.”
Indicators in its reports
named in the reports above- hexane[.]ccin 2 reports
- hxxp://cakrahacker.blogspot[.]comin 1 report
- cakrahacker.blogspot[.]comin 1 report
- shiro-tenshi[.]mlin 1 report
- hxxps://pastebin[.]com/u/anoaghostin 1 report
- 000webhost[.]comin 1 report
- gunz-berry[.]comin 1 report
- yahoo.co[.]idin 1 report
- hxxp://nigeriacyberforce.blogspot[.]ru/in 1 report
- nigeriacyberforce.blogspot[.]ruin 1 report
- hxxps://plus.google[.]com/105478645066963208223/postsin 1 report
- hxxp://www.mp3loaded.com[.]ng/in 1 report
- www.mp3loaded.com[.]ngin 1 report
- hxxp://ictwebsitesolutions[.]comin 1 report
- ictwebsitesolutions[.]comin 1 report
- hxxps://www.instagram[.]com/lekzyone/in 1 report
- hxxps://www.instagram[.]com/Lakhdar***/in 1 report
- news-ar[.]comin 1 report
- geek-ar[.]comin 1 report
- hxxp://lakhdar-dz[.]infoin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.