Tool
Bandizip
- First Reported
- Apr 7, 2026
- Latest Reported
- Apr 7, 2026
Reported Context (2)
- Data exfiltration commonly uses Bandizip for collection and Rclone for synchronization to attacker-owned cloud resources, followed by Medusa ransomware deployment via PDQ Deployer or Group Policy changes for broad Microsoft Details Storm-1175’s Exploitation and Medusa Ransomware Operations
- for payload execution, Impacket and Mimikatz for lateral movement and credential harvesting, and Bandizip and Rclone for data collection and exfiltration. Microsoft Reports Medusa Ransomware Group Rapidly Exploits Vulnerabilities
CVE (2)
Malware (1)
People (2)
Threat Actors (2)
MITRE ATT&CK (20)
Vendors (8)
Products (24)
Tools (7)
Industries (5)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.