DataWagon

Reported Context (1)

was created from VPN or rented hosting, never from 1337 Services: ExpressVPN, NordVPN, CrownCloud, DataWagon, GLOBALTELEHOST, LeaseWeb, Dynu, and Interserver. The rule names were deliberately forgettable: Huntress Details M365 Token-Replay Campaign Affecting 79 Organizations

MITRE ATT&CK (7)

Vendors (10)

Products (10)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.