MinotaurMalware
ransomwareFrom MISP Galaxy
Last reported 8 months ago, by Trend Micro Research1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1553.002Code Signing
“One of campaigns leverage stolen code-signing certificates Cobalt Strike payloads, and exploits (CVE-2020-16040) hosted across multiple C&C domains and IP addresses to maintain persistent access.”
- T1684Social Engineering
“Scripts for social engineering pop-ups designed to deceive victims into downloading and executing malicious files.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups“…tween Campaign Alpha and TheWizard, it’s worth noting that TheWizard also used the DarkNimbus backdoor which was developed by the Earth Minotaur threat actor we discussed in a previous blog entry.”
Indicators in its reports
named in the reports above- 47.238.219[.]111in 1 report
- center.myrnicrosoft[.]comin 1 report
- mkdmcdn[.]comin 1 report
- 162cc325ab7b6e70…52130c56903fin 1 report
- oss-cdn[.]comin 1 report
- bbd2b9b87f968ed8…e30711e8365bin 1 report
- github.githubassets[.]netin 1 report
- 47.238.184[.]9in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.