Sigma

Reported Context (2)

The research package includes a YARA rule and four Sigma documents for these clusters. IronChain Ransomware’s Encryption Design May Make Files Unrecoverable
The Sigma rule System File Execution Location Anomaly was triggered since it looks for execution of commonly abused Windows built-in binaries (consent.exe) outside of their normal path; in this case, the binary executed Bing SEO Poisoning Led to BumbleBee, AdaptixC2 and Akira Ransomware Intrusions

CVE (4)

Malware (4)

People (8)

MITRE ATT&CK (42)

Vendors (9)

Products (14)

Tools (13)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.