Emulating the Hellish Helldown Ransomware
AttackIQ has released a new attack graph emulating the behaviors exhibited by Helldown ransomware since its emergence in August 2024. Helldown is operated by the eponymous and still largely undocumented adversary, which employs double extortion tactics by exfiltrating sensitive data prior to encrypting victim systems and threatening to leak the ... Read More
Emulating the Sophisticated Chinese Adversary Salt Typhoon
AttackIQ has released a new assessment template that emulates the various post-compromise Tactics, Techniques, and Procedures (TTPs) associated with the sabotage-motivated Chinese adversary Salt Typhoon. The post Emulating the Sophisticated Chinese Adversary Salt Typhoon appeared first on AttackIQ ... Read More
Emulating the Deceptive Akira Ransomware
AttackIQ has released a new attack graph emulating the behaviors exhibited by Akira ransomware since its emergence in March 2023. Akira operators provide victims the option to pay for either file decryption or data deletion rather than being forced to pay for both. Reported ransom demands range from 200,000 USD ... Read More
[CISA AA25-050A] #StopRansomware: Ghost (Cring) Ransomware
AttackIQ has released a new attack graph in response to the CISA Advisory (AA25-050A) published on February 19, 2025, which disseminates known Ghost Ransomware Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) identified through FBI investigations as recently as January 2025. The post [CISA AA25-050A] #StopRansomware: Ghost (Cring) ... Read More
Emulating the Financially Motivated Criminal Adversary FIN7 – Part 2
AttackIQ has released two new attack graphs that emulate the behaviors exhibited by the long-standing, financially motivated Russian criminal adversary known as FIN7 based on activities observed between 2022 and 2023. The post Emulating the Financially Motivated Criminal Adversary FIN7 – Part 2 appeared first on AttackIQ ... Read More
Emulating the Splintered Hunters International Ransomware
AttackIQ has released a new attack graph emulating the behaviors exhibited by Hunters International ransomware since its discovery in October 2023. Technical analysis suggests a realistic possibility that Hunters International may have been deployed by actors linked to the disrupted Hive operation. However, while it bears significant similarities, Hunters International ... Read More
Emulating the Splintered Hunters International Ransomware
AttackIQ has released a new attack graph emulating the behaviors exhibited by Hunters International ransomware since its discovery in October 2023. Technical analysis suggests a realistic possibility that Hunters International may have been deployed by actors linked to the disrupted Hive operation. However, while it bears significant similarities, Hunters International ... Read More
Response to CISA Advisory (AA25-022A): Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications
AttackIQ has released a new assessment template in response to the CISA Advisory (AA25-022A) published on January 22, 2025, which details the exploitation of vulnerabilities discovered in Ivanti Cloud Service Appliances during September 2024. The post Response to CISA Advisory (AA25-022A): Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications ... Read More
Response to CISA Advisory (AA25-022A): Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications
AttackIQ has released a new assessment template in response to the CISA Advisory (AA25-022A) published on January 22, 2025, which details the exploitation of vulnerabilities discovered in Ivanti Cloud Service Appliances during September 2024. The post Response to CISA Advisory (AA25-022A): Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications ... Read More
Emulating the Tenacious Ako Ransomware
AttackIQ has released a new attack graph emulating the behaviors exhibited by Ako ransomware since its emergence in January 2020. Contrary to many ransomware strains that focus on individual workstations, Ako targets entire networks, maximizing its impact. It is considered a variant of MedusaLocker due to numerous shared traits, including ... Read More
