ctrlINT What the industry said about every indicator, with the quote

RhinoMalware

Ransomware.From MISP Galaxy

Last reported 28 days ago, by RansomLook3 reports

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1110Brute Force

    “This can be indicative of a brute force or password spraying attack.”

    Elastic Security LabsVendor
  2. T1110.003Password Spraying

    “This can be indicative of a brute force or password spraying attack.”

    Elastic Security LabsVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

3 reports, newest first · the exact sentence from each

  1. “Exfiltrated data categories (~130GB): correspondence (PST archives), CRM contacts (GoldMine), ERP/pricing, engineering CAD (SolidWorks/Rhino), banking statements, insurance policies, tax documentation, legal contracts/NDAs, database backups.”

    RansomLookFeed
    metaencryptor lists FactoryFive

  2. “These printer scripts are written in JavaScript using the embedded Rhino JavaScript engine.”

    HuntressVendor
    Critical Vulnerabilities in PaperCut Print Management Software

  3. “Pacu is a popular framework for exploiting AWS infrastructure, developed and maintained by Rhino Security Labs.”

    Elastic Security LabsVendor
    Security operations: Cloud monitoring and detection with Elastic Security

Indicators in its reports

named in the reports above
Copy these 18 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Rhino here?
No account needed. We do not store your IP address.