EudorIACyber Intelligence
Monitoraggio operativo Newsletter IT EN
← Torna all'intelligence
Ransomware

#StopRansomware: RansomHub Ransomware

Fonte ufficiale
Sintesi operativa EudorIA

Cosa significa

Priorità 95/100

CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware RansomHub. La fonte descrive vulnerabilita o tecniche gia osservate in attacchi e richiede una verifica prioritaria.

Perché conta

L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.

Azioni consigliate

  1. Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
  2. Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
  3. Confermare che backup offline e immutabili siano separati e ripristinabili.
  4. Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.

Benefici operativi potenziali

  • Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
  • Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
  • Validazione documentata della capacita di ripristino
Indicazioni da confermare sul perimetro tecnico e organizzativo del cliente.
Controlli pertinentiVulnerability managementIdentity and access managementNetwork segmentationBackup and recoveryDetection and response
DestinatariITSOCCISOManagement
Centro informazioni

Traduzione in elaborazione

CISA

Il contenuto ufficiale è disponibile nella lingua originale. La versione italiana verrà pubblicata al termine dei controlli automatici.

Testo acquisito dalla fonte

Cybersecurity Advisory #StopRansomware: RansomHub Ransomware Release Date August 29, 2024 Alert Code AA24-242A Related topics: Cyber Threats and Response , Incident Response , Malware, Phishing, and Ransomware Actions to take today to mitigate cyber threats from ransomware: Install updates for operating systems, software, and firmware as soon as they are released. Require phishing-resistant MFA (i.e., non-SMS text based) for as many services as possible. Train users to recognize and report phishing attempts. Summary Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS) (hereafter referred to as the authoring organizations) are releasing this joint advisory to disseminate known RansomHub ransomware IOCs and TTPs. These have been identified through FBI threat response activities and third-party reporting as recently as August 2024. RansomHub is a ransomware-as-a-service variant—formerly known as Cyclops and Knight—that has established itself as an efficient and successful service model (recently attracting high-profile affiliates from other prominent variants such as LockBit

Indicatori CISA verificabili

121 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.

Copertura parziale: sono mostrati solo gli indicatori verificati e interpretabili. 1 allegati richiedono ancora verifica o un formato supportato.

Ultima verifica: 2026-09-26T06:31:10.950637+00:00

Scarica STIX 2.1
TipoIndicatore (non cliccabile)File
urlhttps://samuelelena[.]co/npm/module[.]tripadvisor/module[.]tripadvisor
urlhttp://89[.]23[.]96[.]203/333/en/d%E5%AD%97%E5%AD%97[.]resources/d%E5%AD%97%E5%AD%97[.]resources[.]exe
urlhttp://89[.]23[.]96[.]203/333/en/d%E5%AD%97%E5%AD%97[.]resources/d%E5%AD%97%E5%AD%97[.]resources[.]dll
urlhttp://89[.]23[.]96[.]203/333/en/d%E5%AD%97%E5%AD%97[.]resources[.]exe
urlhttp://89[.]23[.]96[.]203/333/en/d%E5%AD%97%E5%AD%97[.]resources[.]dll
urlhttp://89[.]23[.]96[.]203/333/en-US/d%E5%AD%97%E5%AD%97[.]resources/d%E5%AD%97%E5%AD%97[.]resources[.]exe
urlhttp://89[.]23[.]96[.]203/333/en-US/d%E5%AD%97%E5%AD%97[.]resources/d%E5%AD%97%E5%AD%97[.]resources[.]dll
urlhttp://89[.]23[.]96[.]203/333/en-US/d%E5%AD%97%E5%AD%97[.]resources[.]exe
urlhttp://188[.]34[.]188[.]7/555/NEWOFFICIALPROGRAMCAUSEOFNEWUPDATE[.]INI
urlhttps://40031[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js
urlhttps://40031[.]co/npm/module[.]external/client[.]min[.]js
urlhttps://40031[.]co/npm/module[.]external/moment[.]min[.]js
urlhttps://40031[.]co/npm/module[.]external/jquery[.]min[.]js
urlhttps://40031[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]css
urlhttp://samuelelena[.]co/npm/module[.]external/jquery[.]min[.]js
urlhttp://samuelelena[.]co:443/
urlhttps://samuelelena[.]co/np
urlhttps://samuelelena[.]co/npm/module[.]external
urlhttp://samuelelena[.]co/npm/module[.]external/client[.]min[.]js
urlhttp://samuelelena[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js
urlhttp://samuelelena[.]co/npm/
urlhttps://samuelelena[.]co/npm
urlhttp://samuelelena[.]co/
urlhttps://samuelelena[.]co/
urlhttps://samuelelena[.]co/npm/module[.]external/client[.]min[.]js
urlhttps://samuelelena[.]co/npm/module[.]external/moment[.]min[.]js
urlhttps://12301230[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js
urlhttps://12301230[.]co/npm/module[.]external/client[.]min[.]js
urlhttps://12301230[.]co/npm/module[.]external/moment[.]min[.]js
urlhttps://12301230[.]co/npm/module[.]external/jquery[.]min[.]js
urlhttps://12301230[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]css
urlhttps://i[.]ibb[.]com:443/V3Kj1c2/1154761258[.]png
urlhttps://i[.]ibb[.]co/X2FR8Kz/2113791011[.]png
urlhttps://i[.]ibb[.]co/V3Kj1c2/1154761258[.]png
urlhttps://i[.]ibb[.]co/v1bn9ZK/369210627[.]png
urlhttps://i[.]ibb[.]co/SxQLwYm/1038436121[.]png
urlhttps://i[.]ibb[.]co/p1RCtpy/2681232755[.]png
urlhttps://i[.]ibb[.]co/nbMNnW4/2501108160[.]png
urlhttps://i[.]ibb[.]co/HK0jV1G/534475006[.]png
urlhttps://i[.]ibb[.]co/Fxhyq6t/2077411869[.]png
urlhttps://i[.]ibb[.]co/b1bZBpg/2615174623[.]png
urlhttps://i[.]ibb[.]co/4g6jH2J/2773036704[.]png
urlhttps://i[.]ibb[.]co/2KBydfw/112882618[.]png
urlhttps://grabify[.]link/Y33YXP
urlhttp://temp[.]sh/KnCqD/superloop[.]exe
urlhttp://89[.]23[.]96[.]203/333/xwenxub285p83ecrzvft[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/winnlsres[.]dll
urlhttp://89[.]23[.]96[.]203/333/WINMMBASE[.]dll
urlhttp://89[.]23[.]96[.]203/333/WINMM[.]dll
urlhttp://89[.]23[.]96[.]203/333/WININET[.]dll
urlhttp://89[.]23[.]96[.]203/333/winhttp[.]dll
urlhttp://89[.]23[.]96[.]203/333/webio[.]dll
urlhttp://89[.]23[.]96[.]203/333/USERENV[.]dll
urlhttp://89[.]23[.]96[.]203/333/urlmon[.]dll
urlhttp://89[.]23[.]96[.]203/333/xwenxub285p83ecrzvft[.]exe
urlhttp://89[.]23[.]96[.]203/333/TmsLA6kdcU8jxKzpMvbUVweTeF5YcR[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/SspiCli[.]dll
urlhttp://89[.]23[.]96[.]203/333/msi[.]dll
urlhttp://89[.]23[.]96[.]203/333/mshtml[.]dll
urlhttp://89[.]23[.]96[.]203/333/IPHLPAPI[.]DLL
urlhttp://89[.]23[.]96[.]203/333/information[.]INI
urlhttp://89[.]23[.]96[.]203/333/information[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/information[.]exe
urlhttp://89[.]23[.]96[.]203/333/iertutil[.]dll
urlhttp://89[.]23[.]96[.]203/333/en-US/d%E5%AD%97%E5%AD%97[.]resources[.]dll
urlhttp://89[.]23[.]96[.]203/333/en-US
urlhttp://89[.]23[.]96[.]203/333/en
urlhttp://89[.]23[.]96[.]203/333/DPAPI[.]DLL
urlhttp://89[.]23[.]96[.]203/333/cv4TCGxUjvS[.]exe
urlhttp://89[.]23[.]96[.]203/333/CRYPTSP[.]dll
urlhttp://89[.]23[.]96[.]203/333/cryptnet[.]dll
urlhttp://89[.]23[.]96[.]203/333/CRYPTBASE[.]DLL
urlhttp://89[.]23[.]96[.]203/333/Cabinet[.]dll
urlhttp://89[.]23[.]96[.]203/333/bcrypt[.]dll
urlhttp://89[.]23[.]96[.]203/333/ambapdf[.]ico[.]DLL
urlhttp://89[.]23[.]96[.]203/333/AmbaPDF[.]ico
urlhttp://89[.]23[.]96[.]203/333/92[.]exe
urlhttp://89[.]23[.]96[.]203/333/9[.]exe
urlhttp://89[.]23[.]96[.]203/333/8[.]exe
urlhttp://89[.]23[.]96[.]203/333/7[.]exe
urlhttp://89[.]23[.]96[.]203/333/6[.]exe
urlhttp://89[.]23[.]96[.]203/333/5[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/4[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/3[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/2wrRR6sW6XJtsXyPzuhWhDG7qwN4es[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/2[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/2[.]exe
urlhttp://89[.]23[.]96[.]203/333/12[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/12[.]exe
urlhttp://89[.]23[.]96[.]203/333/10[.]exe
urlhttp://89[.]23[.]96[.]203/333/1[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/1[.]exe
urlhttp://89[.]23[.]96[.]203/333/
urlhttp://89[.]23[.]96[.]203/333
urlhttp://89[.]23[.]96[.]203/
urlhttp://188[.]34[.]188[.]7/555/NEWOFFICIALPROGRAMCAUSEOFNEWUPDATE[.]exe[.]Config
urlhttp://188[.]34[.]188[.]7/555/NEWOFFICIALPROGRAMCAUSEOFNEWUPDATE[.]exe
urlhttp://188[.]34[.]188[.]7/555/en-US
urlhttp://188[.]34[.]188[.]7/555/en
urlhttp://188[.]34[.]188[.]7/555/CRYPTSP[.]dll
urlhttp://188[.]34[.]188[.]7/555/bcrypt[.]dll
urlhttp://188[.]34[.]188[.]7/555/amba16[.]ico
urlhttp://188[.]34[.]188[.]7/555/
urlhttp://188[.]34[.]188[.]7/555
ipv4-addr193[.]233[.]254[.]21
ipv4-addr193[.]124[.]125[.]78
ipv4-addr193[.]106[.]175[.]107
ipv4-addr45[.]134[.]140[.]69
ipv4-addr45[.]95[.]67[.]41
ipv4-addr8[.]211[.]2[.]97
urlhttps://samuelelena[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js
ipv4-addr188[.]34[.]188[.]7
email-addrbrahma2023[@]onionmail[.]org
urlhttp://89[.]23[.]96[.]203/333/5[.]exe
urlhttp://89[.]23[.]96[.]203/333/TmsLA6kdcU8jxKzpMvbUVweTeF5YcR[.]exe
urlhttp://89[.]23[.]96[.]203/333/3[.]exe
urlhttp://89[.]23[.]96[.]203/333/4[.]exe
ipv4-addr89[.]23[.]96[.]203
urlhttp://89[.]23[.]96[.]203/333/2wrRR6sW6XJtsXyPzuhWhDG7qwN4es[.]exe
domain-namesamuelelena[.]co
ipv4-addr45[.]135[.]232[.]2

Provenienza

Allegato ufficiale CISA · 2024-08-28T15:33:18Z

SHA-512: 08c17b6d29010a16e22e24e0cc26dc5a885e5fecfc265f5928eb8a531c71ddb7153e799d677cf32e931434ec1fd538ea602a614e1b5f1029bfaf1daa5bbf8963

Fonte
CISA Cybersecurity Advisories
Entità pubblicatrice
CISA
Tipo entità
Autorità nazionale
Area
North America · US
Lingua originale
en · traduzione in preparazione
Pubblicazione
29/08/2024 14:00
Condivisione
TLP:CLEAR
MITRE ATT&CK
T1003, T1018, T1021.001, T1027, T1036, T1046, T1047, T1048.002, T1048.003, T1059, T1059.001, T1068, T1070, T1098, T1110.003, T1136, T1190, T1210, T1219, T1486, T1490, T1537, T1562.001, T1566, T1588.005
CVE
CVE-2023-3519, CVE-2023-27997, CVE-2023-46604, CVE-2023-22515, CVE-2023-46747, CVE-2023-48788, CVE-2017-0144, CVE-2020-1472, CVE-2020-0787
Classificazione
Critica
Gruppo attribuito dalla fonte
RansomHub
Paese indicato
US
Perimetro tecnico

Prodotti e versioni interessati

Verifica in corso
Informazione non ancora acquisita.

Il collector verificherà NVD e gli advisory vendor ufficiali disponibili.

Azione indicata dalla fonte

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.

Riferimenti tecnici ufficiali

Apri la fonte originale