Happy #DFIRDay!
The DFIR Report has released another detailed report that starts with #Nitrogen malware and ends with #BlackCat ransomware encrypting the files of the victim.
Something that really stood out about this attack was the Persistence technique that was observed. Now I am not going to hit you with the same "Run Registry Keys" and "Windows Startup directory" but it does involve scheduled tasks. And not just the existence of a scheduled task being created but MULTIPLE task creation attempts. Not only does the section highlight the "human element" that exists with cyber attacks, since there were multiple mistakes and typos, but makes you question how often this type of thing occurs in your environment. I know I stand a little outside of organizations and I only have a small window in, but I think that this many attempts from a single or multiple hosts seems like a red flag. In other words, don't just think about the technique, think about frequency and how often this might legitimately exist. Once you understand that, it is easier to find the abnormal! Enjoy the rest of the article and Happy Hunting!
Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#initial-access
Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday Cyborg Security, Now Part of Intel 471