VegaLockerMalware
- buran
- Vega
Delphi-based ransomware.From MISP Galaxy
Last reported 3 days ago, by SecurityWeek30 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1684Social Engineering
“Social Engineering Detection Moves Into the Live Conversation”
- T1036Masquerading
“They also achieved persistence by creating a Windows service masquerading as Microsoft Edge Update to execute a modified copy of the legitimate NSSM utility named msedge.exe with System privileges.”
- T1053.005Scheduled Task
“In November 2023, Rhyne placed scheduled tasks on the firm’s domain controller that would delete 13 domain administrator accounts; change passwords to 301 domain user accounts; change passwords to two local administrator accounts that would impact 254 servers; and change password…”
- T1055Process Injection
“Detects browser process injection initiated originating from the execution of malicious DLL hosted on remote WebDAV UNC path to common browser processes.”
- T1056.001Keylogging
“…d, multi-functional Windows RAT first observed in 2022, XWorm provides attackers with full control over the infected systems, offering keylogging, screenshot capture, webcam access, and payload execution capabilities.”
- T1110.003Password Spraying
“…scan, Nmap, OneForAll, ShuiZe, and WPScan for reconnaissance, and command-line exploit utilities and the EBurst Microsoft Exchange password spraying tool for initial access.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
30 reports · the newest 20, newest first · the exact sentence from each-
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors“Vega saw exploit attempts in the wild that leveraged a public PoC.”
-
Small AI Models May Soon Be Able to Self-Replicate on IoT Devices, Anthropic Warns“Scott Simkin has joined Vega as CMO.”
-
XWorm RAT Evolves Into Surveillance Platform“Scott Simkin has joined Vega as CMO.”
-
AI Turns Familiar Cyberattacks Into a Race Against Time“Scott Simkin has joined Vega as CMO.”
-
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant“Scott Simkin has joined Vega as CMO.”
-
Cyberattack Prompts Ahold Delhaize to Disconnect Systems“Scott Simkin has joined Vega as CMO.”
-
Refrigeration Controller Hack Spoils Food Across European Supermarkets“Scott Simkin has joined Vega as CMO.”
-
IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion“Scott Simkin has joined Vega as CMO.”
-
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild“Scott Simkin has joined Vega as CMO.”
-
Canonical Websites Disrupted in Second DDoS Attack This Year“Scott Simkin has joined Vega as CMO.”
-
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US“Scott Simkin has joined Vega as CMO.”
-
iRhythm Data Breach Impacts at Least 360,000 People“Scott Simkin has joined Vega as CMO.”
-
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe“Scott Simkin has joined Vega as CMO.”
-
Critical SonicWall Vulnerability Exploited Days After Disclosure“Scott Simkin has joined Vega as CMO.”
-
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch“Scott Simkin has joined Vega as CMO.”
-
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison“Scott Simkin has joined Vega as CMO.”
-
OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks“Scott Simkin has joined Vega as CMO.”
-
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years“Scott Simkin has joined Vega as CMO.”
-
Google Domains Impacted by Recent ccTLD Hijacks“Scott Simkin has joined Vega as CMO.”
-
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries“Scott Simkin has joined Vega as CMO.”
Indicators in its reports
named in the reports above- doxx[.]netin 3 reports
Copy this indicator · defanged
Thanks — we review every report.