coinbasecartel

Víctimas recientes

• T1098.003 Account Manipulation: Additional Cloud Credentials — Adding new secrets or keys to existing OAuth applications to maintain access even after password changes.
• T1136.001 Create Account: Local Account — Creation of "ghost" administrator users on VMware hosts.

• T1036.005 Masquerading: Match Legitimate Name or Location — Renaming malicious binaries to names of critical VMware processes or backup tools.
• T1070.001 Indicator Removal: Clear Windows Event Logs — Systematic cleaning of syslogs and audit logs in ESXi environments.
• T1562.001 Impair Defenses: Disable or Modify Tools — Disabling virtual machine snapshots before encryption (when they opt for it).

• T1018 Remote System Discovery — Enumeration of Active Directory objects from non-privileged user accounts.
• T1083 File and Directory Discovery — Scanning vCenter datastores to identify critical VMs and databases.
• T1538 Cloud Service Dashboard — Exploration of AWS/Azure consoles to identify EBS volumes and S3 instances.

• T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage — Use of tools like Rclone to send data to providers such as Mega or Dropbox.

• T1486 Data Encrypted for Impact — Secondary technique, focused on .vmdk files via shinysp1d3r loader.
• T1657 Financial Theft — Direct extortion based on the threat of leaking data on Onion forums (DLS).