MeowMalware
According to PCrisk, MEOW is ransomware based on other ransomware called CONTI. MEOW encrypts files and appends the ". MEOW" extension to their filenames. It also drops the "readme.txt" file (a ransom note). An example of how MEOW ransomware modifies filenames: it renames "1.jpg" to "1.jpg. MEOW", "2.png" to "2.png. MEOW", and so forth.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Threat Actors Impacting the Financial Sector in 2024“During 2024, numerous ransomware groups such as RansomHub, Scattered Spider, Qilin (aka Agenda), LockBit, and Meow, publicly claimed financial entities as victims.”
-
De-obfuscating ALCATRAZ“printf("Meow %d",c);”
Indicators in its reports
named in the reports above- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- 185.147.125[.]81in 1 report
- 3050c464360ba700…67b930e1f7fdin 1 report
- hxxps://github[.]com/weak1337/Alcatrazin 1 report
- hxxps://gitlab[.]com/eshard/d810in 1 report
- hxxps://eshard[.]com/posts/d810-deobfuscation-ida-proin 1 report
- eshard[.]comin 1 report
- hxxp://keowu[.]re/posts/Analyzing-Mutation-Coded-VM-Protect-and-Alcatraz-English/in 1 report
- keowu[.]rein 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.