Loading story…
Attackers used Windows services, stolen or abused administrative access, and legitimate remote-management tools to prepare and launch a Midas ransomware intrusion against an unnamed technology vendor. The operation reportedly lasted at least two months before ransomware was deployed, with the attackers moving laterally through the environment using PowerShell, DISM, RDP, AnyDesk, TeamViewer, and Process Hacker, while also harvesting credentials and exfiltrating data. Investigators found evidence of Mimikatz use on at least one server, abuse of administrator-level access on a domain controller, and the creation of services to execute obfuscated scripts and malicious DismCore.dll backdoors.
The victim’s environment reportedly enabled the intrusion through a flat network, broad VPN access, weak segmentation, and unused remote-access tools left installed on servers. Ransomware deployment began in early December, but the impact was limited to a small number of servers after incident responders intervened and blocked further attacker activity. The case highlights the operational risk posed by unmanaged remote-control software and insufficient monitoring of service creation, lateral movement, privileged access, and remote administration pathways, alongside the need for MFA and stronger segmentation or ZTNA-style controls.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
Sophos Rapid Response was engaged and blocked further attacker activity, limiting the ransomware impact to a small number of servers.
The attackers began deploying Midas ransomware across the victim environment, transitioning from stealthy intrusion activity to overt impact.
Investigators observed another pause in attacker activity after November 29, shortly before the ransomware stage began.
The attackers made further internal RDP connections during this period, indicating continued lateral movement before ransomware deployment.
Logs showed a file named Passwords.txt containing harvested credentials was written under C:\Compaq\!logs\ on a compromised domain controller, and some machines detected and blocked Mimikatz the same day.
Investigators believe the attackers successfully executed Mimikatz on at least one server the day before detections occurred elsewhere, as part of credential harvesting activity.
The attackers resumed activity by installing services and executing PowerShell scripts on additional machines, expanding their foothold in the victim environment.
The intrusion entered another pause after November 2 before later resuming, reflecting repeated stop-start attacker behavior during the dwell period.
Investigators found evidence that AnyDesk had been used 13 times on one compromised server, showing the attackers were leveraging commercial remote access software for movement or exfiltration.
Investigators observed a lull in attacker activity after October 19, suggesting the intrusion proceeded in intermittent stages rather than continuously.
The earliest logged indicator of compromise occurred when two different internal machines used RDP to log into a compromised domain controller as Administrator, indicating the attackers had obtained or abused high-level access.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers behind a **Midas ransomware** intrusion spent at least two months inside an unnamed technology vendor before launching encryption, using a combination of internal **RDP**, **PowerShell**, **DISM**, **AnyDesk**, **TeamViewer**, and **Process Hacker** (now known as **System Informer**) to move laterally and prepare the environment. Investigators found evidence that the intruders gained administrator-level access to a domain controller, harvested credentials with **Mimikatz**, exfiltrated data, and repeatedly created malicious **Windows services** to maintain access and stage the attack. The operation culminated in the deployment of a malicious `DismCore.dll` through **DLL sideloading** and the start of ransomware activity on a limited number of servers. Response efforts interrupted the attack before broader encryption could occur, but the case highlighted how a flat network, unused remote-access tools, weak monitoring, and the absence of **MFA** increased the victim’s exposure and enabled the attackers to establish persistence, escalate privileges, and advance toward ransomware execution.
Aug 14, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Multiple incident reports show attackers repeatedly using exposed or weakly protected **Remote Desktop Protocol (RDP)** as both an entry point and an internal movement channel. In one intrusion, an actor brute-forced a local administrator account over RDP, created additional access, used **Mimikatz** to dump credentials and Kerberos tickets, and moved across systems before deploying an **XMRig**-based Monero miner. Separate reporting on **Conti** and other hands-on-keyboard operations shows similar post-compromise tradecraft, including credential theft, reconnaissance, use of remote management utilities, and abuse of legitimate Windows administration features to avoid dropping obvious backdoors. Ransomware and espionage cases show the same pattern extending to interactive remote-control tooling beyond standard RDP. ASEC reported **Crysis/Dharma** and **Venus** ransomware actors brute-forcing RDP, stealing credentials, terminating processes, deleting shadow copies, and encrypting systems, sometimes retrying with a second ransomware family after a failed first attempt. North Korea-linked **Kimsuky** has also used **RDP Wrapper**, patched Terminal Services, **VNC**, **Chrome Remote Desktop**, **Ngrok**, and malware such as **AppleSeed**, **Amadey**, and **RftRAT** to maintain GUI-based access, evade user awareness, and support keylogging, file theft, and persistent control of compromised hosts.
Aug 14, 2026