RakhniMalware
- agent.iih
- Aura
- autoit
- bandarchor
- cryptokluchen
- isda
- lamer
- pletor
Ransomware Files might be partially encryptedFrom MISP Galaxy
Last reported 19 days ago, by Help Net Security3 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1684Social Engineering
“ShinyHunters is known for vishing, a social engineering tactic in which attackers call employees while posing as IT support staff and trick them into handing over sensitive information.”
- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1078Valid Accounts
“API requests for configuration information on Salesforce Communities & Sites instances (T1078 - Valid Accounts)”
- T1110Brute Force
“High frequency of failed login attempts using weak MFA methods (T1110 - Brute Force)”
- T1110.004Credential Stuffing
“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Detained ShinyHunters hacker reportedly helping FBI track down fellow members“The group has stepped up its activity in recent months, with breaches at ADT, the European Commission, Aura and Rockstar Games attributed to it.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“They are systematically scanning for misconfigured Salesforce Experience Cloud (Aura) deployments and SaaS supply-chain token theft, running from Drift through Gainsight to Anodot.”
-
Mapping out your unknown: A threat hunter’s guide to Salesforce“Attackers may attempt to access configuration information on Salesforce sites, observable through Aura Request events, by using a guest or compromised internal user account.”
Indicators in its reports
named in the reports above- security[.]orgin 1 report
- azurenetfiles[.]netin 1 report
- 142.11.200[.]186in 1 report
- politie[.]nlin 1 report
- evt[.]namein 1 report
- secure[.]comin 1 report
- promo[.]comin 1 report
- raidforums[.]comin 1 report
- rf[.]wsin 1 report
- raid[.]lolin 1 report
- breachforums[.]stin 1 report
- breachforums[.]hnin 1 report
- task[.]namein 1 report
- fa210f015399de16…94972a3bdc43in 1 report
- d5efdf6f35e9c6ed…3d591b94e384in 1 report
- a4e525d8825c1bac…799e07e207e4in 1 report
- classaction[.]orgin 1 report
- w[.]mediain 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.