Loading malware…
4 distinct techniques documented for this family, organized by ATT&CK tactic.
"get_domain_computers"; the assessment also describes the operator as "running the same AD-compromise playbook."
"The encryptor sits in the operator's own directory, ready to deploy"; "encryptor staging."
"It runs through credential theft, domain compromise, exfiltration, encryptor staging"; "scp".
"The encryptor sits in the operator's own directory, ready to deploy"; "A key recovered from the Aurora encryptor".
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.