home.social

#ransomwareasaservice — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #ransomwareasaservice, aggregated by home.social.

  1. Inside Vect Ransomware-as-a-Service

    Pulse ID: 69f97a709f2e7dddc097dbd2
    Pulse Link: otx.alienvault.com/pulse/69f97
    Pulse Author: Tr1sa111
    Created: 2026-05-05 05:04:48

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #RansomWare #RansomwareAsAService #bot #Tr1sa111

  2. Inside Vect Ransomware-as-a-Service

    Vect ransomware emerged in January 2026 as a new threat actor operating a Ransomware-as-a-Service program with strategic partnerships that significantly expand its reach. The group has partnered with TeamPCP, known for supply chain attacks compromising security tools like Trivy, KICS, and LiteLLM, and BreachForums, distributing affiliate keys to forum members. With 25 published victims primarily targeting the United States and Technology sector, Vect maintains an open affiliate program requiring only a $250 invite code. The operation offers multi-platform ransomware payloads for Windows, Linux, and ESXi with sophisticated lateral movement capabilities and tiered commission structures reaching 89% for top affiliates. Analysis reveals connections to the defunct Devman ransomware through shared code strings and ransom note similarities, suggesting possible rebranding or code reuse.

    Pulse ID: 69f3e870bcc7ccaa076150b1
    Pulse Link: otx.alienvault.com/pulse/69f3e
    Pulse Author: AlienVault
    Created: 2026-04-30 23:40:32

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Linux #OTX #OpenThreatExchange #RAT #RansomWare #RansomwareAsAService #SupplyChain #UnitedStates #Windows #bot #AlienVault

  3. Inside Vect Ransomware-as-a-Service

    Vect ransomware emerged in January 2026 as a new threat actor operating a Ransomware-as-a-Service program with strategic partnerships that significantly expand its reach. The group has partnered with TeamPCP, known for supply chain attacks compromising security tools like Trivy, KICS, and LiteLLM, and BreachForums, distributing affiliate keys to forum members. With 25 published victims primarily targeting the United States and Technology sector, Vect maintains an open affiliate program requiring only a $250 invite code. The operation offers multi-platform ransomware payloads for Windows, Linux, and ESXi with sophisticated lateral movement capabilities and tiered commission structures reaching 89% for top affiliates. Analysis reveals connections to the defunct Devman ransomware through shared code strings and ransom note similarities, suggesting possible rebranding or code reuse.

    Pulse ID: 69f3e870bcc7ccaa076150b1
    Pulse Link: otx.alienvault.com/pulse/69f3e
    Pulse Author: AlienVault
    Created: 2026-04-30 23:40:32

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Linux #OTX #OpenThreatExchange #RAT #RansomWare #RansomwareAsAService #SupplyChain #UnitedStates #Windows #bot #AlienVault

  4. Inside Vect Ransomware-as-a-Service

    Vect ransomware emerged in January 2026 as a new threat actor operating a Ransomware-as-a-Service program with strategic partnerships that significantly expand its reach. The group has partnered with TeamPCP, known for supply chain attacks compromising security tools like Trivy, KICS, and LiteLLM, and BreachForums, distributing affiliate keys to forum members. With 25 published victims primarily targeting the United States and Technology sector, Vect maintains an open affiliate program requiring only a $250 invite code. The operation offers multi-platform ransomware payloads for Windows, Linux, and ESXi with sophisticated lateral movement capabilities and tiered commission structures reaching 89% for top affiliates. Analysis reveals connections to the defunct Devman ransomware through shared code strings and ransom note similarities, suggesting possible rebranding or code reuse.

    Pulse ID: 69f3e870bcc7ccaa076150b1
    Pulse Link: otx.alienvault.com/pulse/69f3e
    Pulse Author: AlienVault
    Created: 2026-04-30 23:40:32

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Linux #OTX #OpenThreatExchange #RAT #RansomWare #RansomwareAsAService #SupplyChain #UnitedStates #Windows #bot #AlienVault

  5. Inside Vect Ransomware-as-a-Service

    Vect ransomware emerged in January 2026 as a new threat actor operating a Ransomware-as-a-Service program with strategic partnerships that significantly expand its reach. The group has partnered with TeamPCP, known for supply chain attacks compromising security tools like Trivy, KICS, and LiteLLM, and BreachForums, distributing affiliate keys to forum members. With 25 published victims primarily targeting the United States and Technology sector, Vect maintains an open affiliate program requiring only a $250 invite code. The operation offers multi-platform ransomware payloads for Windows, Linux, and ESXi with sophisticated lateral movement capabilities and tiered commission structures reaching 89% for top affiliates. Analysis reveals connections to the defunct Devman ransomware through shared code strings and ransom note similarities, suggesting possible rebranding or code reuse.

    Pulse ID: 69f3e870bcc7ccaa076150b1
    Pulse Link: otx.alienvault.com/pulse/69f3e
    Pulse Author: AlienVault
    Created: 2026-04-30 23:40:32

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Linux #OTX #OpenThreatExchange #RAT #RansomWare #RansomwareAsAService #SupplyChain #UnitedStates #Windows #bot #AlienVault

  6. Inside Vect Ransomware-as-a-Service

    Vect ransomware emerged in January 2026 as a new threat actor operating a Ransomware-as-a-Service program with strategic partnerships that significantly expand its reach. The group has partnered with TeamPCP, known for supply chain attacks compromising security tools like Trivy, KICS, and LiteLLM, and BreachForums, distributing affiliate keys to forum members. With 25 published victims primarily targeting the United States and Technology sector, Vect maintains an open affiliate program requiring only a $250 invite code. The operation offers multi-platform ransomware payloads for Windows, Linux, and ESXi with sophisticated lateral movement capabilities and tiered commission structures reaching 89% for top affiliates. Analysis reveals connections to the defunct Devman ransomware through shared code strings and ransom note similarities, suggesting possible rebranding or code reuse.

    Pulse ID: 69f3e870bcc7ccaa076150b1
    Pulse Link: otx.alienvault.com/pulse/69f3e
    Pulse Author: AlienVault
    Created: 2026-04-30 23:40:32

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #ICS #InfoSec #Linux #OTX #OpenThreatExchange #RAT #RansomWare #RansomwareAsAService #SupplyChain #UnitedStates #Windows #bot #AlienVault

  7. The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

    The Gentlemen ransomware-as-a-service program has rapidly expanded since mid-2025, claiming over 320 victims with 240 attacks occurring in early 2026. The service provides multi-platform lockers for Windows, Linux, NAS, BSD, and ESXi, enabling comprehensive coverage of corporate environments. During an incident response engagement, an affiliate deployed SystemBC proxy malware for covert tunneling and payload delivery. Analysis of the SystemBC command-and-control server revealed a botnet of over 1,570 victims, primarily corporate and organizational targets. The intrusion progressed from domain controller compromise through credential validation, remote execution via administrative shares, and deployment of Cobalt Strike payloads. Attackers disabled defenses, established persistence through scheduled tasks and services, and ultimately deployed ransomware via Group Policy. The operation demonstrates sophisticated lateral movement capabilities, defense evasion techniques, and integration of mature post-exploit...

    Pulse ID: 69e63f93a0ddbd53fcab3f51
    Pulse Link: otx.alienvault.com/pulse/69e63
    Pulse Author: AlienVault
    Created: 2026-04-20 15:00:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CobaltStrike #CyberSecurity #DomainController #InfoSec #Linux #Malware #OTX #OpenThreatExchange #Proxy #RAT #RansomWare #RansomwareAsAService #Troll #Windows #bot #botnet #AlienVault

  8. The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

    The Gentlemen ransomware-as-a-service program has rapidly expanded since mid-2025, claiming over 320 victims with 240 attacks occurring in early 2026. The service provides multi-platform lockers for Windows, Linux, NAS, BSD, and ESXi, enabling comprehensive coverage of corporate environments. During an incident response engagement, an affiliate deployed SystemBC proxy malware for covert tunneling and payload delivery. Analysis of the SystemBC command-and-control server revealed a botnet of over 1,570 victims, primarily corporate and organizational targets. The intrusion progressed from domain controller compromise through credential validation, remote execution via administrative shares, and deployment of Cobalt Strike payloads. Attackers disabled defenses, established persistence through scheduled tasks and services, and ultimately deployed ransomware via Group Policy. The operation demonstrates sophisticated lateral movement capabilities, defense evasion techniques, and integration of mature post-exploit...

    Pulse ID: 69e63f93a0ddbd53fcab3f51
    Pulse Link: otx.alienvault.com/pulse/69e63
    Pulse Author: AlienVault
    Created: 2026-04-20 15:00:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CobaltStrike #CyberSecurity #DomainController #InfoSec #Linux #Malware #OTX #OpenThreatExchange #Proxy #RAT #RansomWare #RansomwareAsAService #Troll #Windows #bot #botnet #AlienVault

  9. The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

    The Gentlemen ransomware-as-a-service program has rapidly expanded since mid-2025, claiming over 320 victims with 240 attacks occurring in early 2026. The service provides multi-platform lockers for Windows, Linux, NAS, BSD, and ESXi, enabling comprehensive coverage of corporate environments. During an incident response engagement, an affiliate deployed SystemBC proxy malware for covert tunneling and payload delivery. Analysis of the SystemBC command-and-control server revealed a botnet of over 1,570 victims, primarily corporate and organizational targets. The intrusion progressed from domain controller compromise through credential validation, remote execution via administrative shares, and deployment of Cobalt Strike payloads. Attackers disabled defenses, established persistence through scheduled tasks and services, and ultimately deployed ransomware via Group Policy. The operation demonstrates sophisticated lateral movement capabilities, defense evasion techniques, and integration of mature post-exploit...

    Pulse ID: 69e63f93a0ddbd53fcab3f51
    Pulse Link: otx.alienvault.com/pulse/69e63
    Pulse Author: AlienVault
    Created: 2026-04-20 15:00:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CobaltStrike #CyberSecurity #DomainController #InfoSec #Linux #Malware #OTX #OpenThreatExchange #Proxy #RAT #RansomWare #RansomwareAsAService #Troll #Windows #bot #botnet #AlienVault

  10. The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

    The Gentlemen ransomware-as-a-service program has rapidly expanded since mid-2025, claiming over 320 victims with 240 attacks occurring in early 2026. The service provides multi-platform lockers for Windows, Linux, NAS, BSD, and ESXi, enabling comprehensive coverage of corporate environments. During an incident response engagement, an affiliate deployed SystemBC proxy malware for covert tunneling and payload delivery. Analysis of the SystemBC command-and-control server revealed a botnet of over 1,570 victims, primarily corporate and organizational targets. The intrusion progressed from domain controller compromise through credential validation, remote execution via administrative shares, and deployment of Cobalt Strike payloads. Attackers disabled defenses, established persistence through scheduled tasks and services, and ultimately deployed ransomware via Group Policy. The operation demonstrates sophisticated lateral movement capabilities, defense evasion techniques, and integration of mature post-exploit...

    Pulse ID: 69e63f93a0ddbd53fcab3f51
    Pulse Link: otx.alienvault.com/pulse/69e63
    Pulse Author: AlienVault
    Created: 2026-04-20 15:00:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CobaltStrike #CyberSecurity #DomainController #InfoSec #Linux #Malware #OTX #OpenThreatExchange #Proxy #RAT #RansomWare #RansomwareAsAService #Troll #Windows #bot #botnet #AlienVault

  11. The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

    The Gentlemen ransomware-as-a-service program has rapidly expanded since mid-2025, claiming over 320 victims with 240 attacks occurring in early 2026. The service provides multi-platform lockers for Windows, Linux, NAS, BSD, and ESXi, enabling comprehensive coverage of corporate environments. During an incident response engagement, an affiliate deployed SystemBC proxy malware for covert tunneling and payload delivery. Analysis of the SystemBC command-and-control server revealed a botnet of over 1,570 victims, primarily corporate and organizational targets. The intrusion progressed from domain controller compromise through credential validation, remote execution via administrative shares, and deployment of Cobalt Strike payloads. Attackers disabled defenses, established persistence through scheduled tasks and services, and ultimately deployed ransomware via Group Policy. The operation demonstrates sophisticated lateral movement capabilities, defense evasion techniques, and integration of mature post-exploit...

    Pulse ID: 69e63f93a0ddbd53fcab3f51
    Pulse Link: otx.alienvault.com/pulse/69e63
    Pulse Author: AlienVault
    Created: 2026-04-20 15:00:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CobaltStrike #CyberSecurity #DomainController #InfoSec #Linux #Malware #OTX #OpenThreatExchange #Proxy #RAT #RansomWare #RansomwareAsAService #Troll #Windows #bot #botnet #AlienVault

  12. AI is changing the ransomware game—making high-stakes attacks accessible even to amateurs and pushing average ransom payments into the millions. How are companies gearing up to fight back?

    thedefendopsdiaries.com/how-ai

    #ai
    #ransomware
    #cybersecurity
    #threatlandscape
    #ransomwareasaservice

  13. AI is changing the ransomware game—making high-stakes attacks accessible even to amateurs and pushing average ransom payments into the millions. How are companies gearing up to fight back?

    thedefendopsdiaries.com/how-ai

    #ai
    #ransomware
    #cybersecurity
    #threatlandscape
    #ransomwareasaservice

  14. AI is changing the ransomware game—making high-stakes attacks accessible even to amateurs and pushing average ransom payments into the millions. How are companies gearing up to fight back?

    thedefendopsdiaries.com/how-ai

    #ai
    #ransomware
    #cybersecurity
    #threatlandscape
    #ransomwareasaservice

  15. StopRansomware: RansomHub Ransomware

    RansomHub is a ransomware-as-a-service variant that has targeted over 210 victims across various critical infrastructure sectors since February 2024. It employs a double-extortion model, encrypting systems and exfiltrating data. The ransom note provides victims with a client ID and instructions to contact the group via a Tor URL. Affiliates typically gain initial access through phishing, exploiting vulnerabilities, and password spraying. They use tools like Mimikatz for credential theft and privilege escalation, and move laterally using RDP, PsExec, and other methods. Data exfiltration varies by affiliate but may involve tools like PuTTY and AWS S3 buckets. The ransomware uses Curve 25519 encryption and implements intermittent encryption. It targets user files and networked shares, leaving a ransom note and deleting volume shadow copies.

    Pulse ID: 66d204f1d658869764c07d47
    Pulse Link: otx.alienvault.com/pulse/66d20
    Pulse Author: AlienVault
    Created: 2024-08-30 17:44:17

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #AWS #CyberSecurity #Encryption #Extortion #InfoSec #OTX #OpenThreatExchange #Password #Phishing #PsExec #RAT #RDP #RansomWare #RansomwareAsAService #StopRansomware #Word #bot #AlienVault

  16. Für Cybergangster fing das Jahr schlecht an: Auf die Verhaftungen von Emotet- und NetWalker-Drahtziehern folgten nun Festnahmen im Zusammenhang mit Egregor.
    Ransomware Egregor: Mehrere Affiliates verhaftet, Leak-Website offline