Loading story…
Attackers behind a Midas ransomware intrusion spent at least two months inside an unnamed technology vendor before launching encryption, using a combination of internal RDP, PowerShell, DISM, AnyDesk, TeamViewer, and Process Hacker (now known as System Informer) to move laterally and prepare the environment. Investigators found evidence that the intruders gained administrator-level access to a domain controller, harvested credentials with Mimikatz, exfiltrated data, and repeatedly created malicious Windows services to maintain access and stage the attack.
The operation culminated in the deployment of a malicious DismCore.dll through DLL sideloading and the start of ransomware activity on a limited number of servers. Response efforts interrupted the attack before broader encryption could occur, but the case highlighted how a flat network, unused remote-access tools, weak monitoring, and the absence of MFA increased the victim’s exposure and enabled the attackers to establish persistence, escalate privileges, and advance toward ransomware execution.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Sophos Rapid Response was engaged on December 8 and blocked further attacker activity. As a result, the ransomware impact was limited to a small number of servers.
Late on December 7, attackers began deploying ransomware binaries named for the target organization to victim machines. They also created a Windows service to run Process Hacker and used PowerShell to try to terminate dozens of processes and services before encryption.
Antivirus detected Mimikatz on one server, while investigators believed the tool had been successfully executed on another server the previous day. The finding showed active credential-harvesting during the intrusion.
After a three-week lull, the attackers became active again in the victim environment. The renewed activity preceded credential theft detections and further internal movement.
The attackers resumed activity on additional machines, again using service creation and PowerShell execution. This marked a renewed phase of lateral movement after the earlier October activity.
Investigators observed additional internal RDP connections during this period, indicating continued lateral movement inside the victim network. The activity followed the Mimikatz-related detections.
Logs showed a successful RDP login to a compromised domain controller using the Administrator account. Investigators cited this as evidence of administrator-level access during the intrusion.
Between October 13 and October 19, attackers created malicious Windows services and used PowerShell over SMB to spread backdoors across multiple servers. This activity established persistence and prepared later lateral movement.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **Windows services**, stolen or abused administrative access, and legitimate remote-management tools to prepare and launch a **Midas ransomware** intrusion against an unnamed technology vendor. The operation reportedly lasted at least two months before ransomware was deployed, with the attackers moving laterally through the environment using **PowerShell**, **DISM**, **RDP**, **AnyDesk**, **TeamViewer**, and **Process Hacker**, while also harvesting credentials and exfiltrating data. Investigators found evidence of **Mimikatz** use on at least one server, abuse of administrator-level access on a domain controller, and the creation of services to execute obfuscated scripts and malicious `DismCore.dll` backdoors. The victim’s environment reportedly enabled the intrusion through a flat network, broad VPN access, weak segmentation, and unused remote-access tools left installed on servers. Ransomware deployment began in early December, but the impact was limited to a small number of servers after incident responders intervened and blocked further attacker activity. The case highlights the operational risk posed by unmanaged remote-control software and insufficient monitoring of service creation, lateral movement, privileged access, and remote administration pathways, alongside the need for **MFA** and stronger segmentation or **ZTNA**-style controls.
Aug 14, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Mandiant reported that **DARKSIDE** operated as a ransomware-as-a-service group that combined data theft and file encryption, with affiliates conducting intrusions that moved from initial access to hands-on-keyboard post-exploitation before deploying ransomware. The group’s operations were associated with common enterprise attack tooling and tradecraft designed to blend into Windows environments, helping operators maintain access, move laterally, and prepare victim networks for extortion. The referenced techniques and detections show how that activity can appear on endpoints: adversaries may abuse trusted Microsoft utilities `Regsvcs` and `Regasm` under MITRE ATT&CK **`T1218.009`** to proxy malicious .NET code execution and evade application controls, while post-compromise activity may also surface through **Cobalt Strike** named pipes tied to Beacon, Artifact Kit, and Malleable C2 profiles. Splunk previously published analytics based on Sysmon Event IDs **17** and **18** to identify those pipe patterns, underscoring how defenders can spot the command-and-control and lateral movement behavior often seen in ransomware intrusions linked to groups such as DARKSIDE.
Aug 15, 2026