thegentlemen

Víctimas recientes

• T1136 Create Account — Creation of accounts for persistence.
• T1543 Create or Modify System Process — Velociraptor deployed as a SYSTEM-level Windows service via MSI (Server.Utils.CreateMSI artifact) for persistent beacon access.
• T1547 Boot or Logon Autostart Execution — Boot or logon autostart execution for persistence.

• T1068 Exploitation for Privilege Escalation — Exploitation of vulnerabilities for privilege escalation.
• T1187 Forced Authentication — PetitPotam coercion via NXC coerce_plus module to trigger NTLM authentication from domain hosts toward attacker-controlled relay listener.
• T1557 Adversary-in-the-Middle — Responder (SMB/HTTP disabled) combined with ntlmrelayx targeting LDAP for machine account creation. RelayKing used to scan SMB/LDAP/MSSQL/HTTP/RPC/WinRM relay opportunities.

• T1027 Obfuscated Files or Information — Obfuscation of files or information to evade detection.
• T1070 Indicator Removal — Automated post-compromise script clears all Windows Event Logs via wevtutil, removes RDP MRU registry keys, deletes .rdp files, empties Recycle Bin, and clears RDP/SMB/WinRM logs.
• T1090 Proxy — ProxyChains (Windows/Linux), SSH dynamic port forwarding (-NfD 1080), ProxyJump multi-hop pivoting. Self-hosted double-VPN with WireGuard/OpenVPN and Amnezia VPN for operator anonymity.
• T1112 Modify Registry — Modifying the registry for defense evasion.
• T1484.001 Domain Policy Modification: Group Policy Modification — Modification of Group Policy for defense evasion.
• T1562 Impair Defenses — Impairing defenses to avoid detection.
• T1562.001 Impair Defenses: Disable or Modify Tools — BYOVD drivers ($3500-$5000 darknet), EDRStartupHinder, GFreeze/GLinker against CrowdStrike, IFEO registry redirecting EDR processes to calc.exe, WMI GlobalLogger/WPR symlink attacks to overwrite EDR binaries on boot.

• T1003 OS Credential Dumping — XenAllPasswordPro deployed via SMB for mass browser credential harvesting across all hosts. KslDump/KslKatz for LSASS dumping. Velociraptor for full memory dumps without AV detection. Pass-the-Hash via xfreerdp.
• T1110 Brute Force — Custom FortiGate panel bruter on dedicated hardware (dual Xeon, 120GB RAM) targeting non-standard ports. Credential spraying with known default passwords. Hydra for email spraying. Hash cracking via crackmd5.ru and chamd5.org.
• T1552 Unsecured Credentials — FortiGate configuration files exfiltrated containing plaintext LDAP credentials, local VPN user passwords, and IPSec pre-shared keys. MANSPIDER used to search SMB shares for credential files.
• T1555 Credentials from Password Stores — DumpBrowserSecrets used for browser credential and session cookie theft. Cookies imported via Cookie-Editor extension to hijack authenticated M365/CRM/email sessions.

• T1018 Remote System Discovery — gogo internal port scanner across /24 subnets (ports 22,53,80,88,389,443,445,636,3389,1433,5985) with 100 threads and ICMP ping. NetExec for SMB/WinRM/LDAP host enumeration.
• T1046 Network Service Discovery — Discovery of network services.
• T1069 Permission Groups Discovery — BloodHound/CertiHound for AD and AD CS (ESC1-ESC17) enumeration. ADFind and ldapdomaindump for group/permission mapping. PrivHound for LPE vector identification within AD.
• T1087 Account Discovery — Discovery of accounts within the environment.
• T1087.002 Account Discovery: Domain Account — Discovery of domain accounts within the environment.
• T1482 Domain Trust Discovery — Discovery of domain trust relationships.
• T1526 Cloud Service Discovery — AWS S3 buckets and EKS clusters enumerated post-access. Censys, Shodan, ZoomInfo, and c99.nl API used for external recon of VPN endpoints and subdomains.

• T1021 Remote Services — Use of remote services for lateral movement.
• T1021.001 Remote Services: Remote Desktop Protocol — Use of RDP for lateral movement.
• T1021.002 Remote Services: SMB/Windows Admin Shares — Use of SMB/Windows Admin Shares for lateral movement.
• T1021.004 Remote Services: SSH — Use of SSH for lateral movement.
• T1563 Remote Service Session Hijacking — Browser session cookies stolen via DumpBrowserSecrets and replayed via Cookie-Editor to hijack authenticated web application sessions (email, M365, CRM portals).

• T1005 Data from Local System — XenAllPasswordPro HTML credential reports collected per host. SQL database full dumps via phpMyAdmin exported to SFTP. File system enumeration targeting CRM code, backups, and financial data.
• T1039 Data from Network Shared Drive — Collection of data from network shared drives.
• T1074 Data Staged — Staging of collected data prior to exfiltration.
• T1074.001 Data Staged: Local Data Staging — Local staging of collected data prior to exfiltration.
• T1114 Email Collection — Corporate OWA mailboxes accessed via purchased stealer logs (snusbase.com) to harvest internal communications, credentials, and sensitive documents.

• T1048 Exfiltration Over Alternative Protocol — Exfiltration of data over encrypted channels.
• T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol — Exfiltration over symmetric encrypted non-C2 channels.
• T1537 Transfer Data to Cloud Account — rclone to actor-controlled SFTP servers with high-parallelism (--transfers 16 --multi-thread-streams 8 --buffer-size 256M). Observed volumes: 13GB NAS, 3+TB Docker/Nexus, 100+GB Confluence/JIRA.

• T1071 Application Layer Protocol — Use of application layer protocols for C2 communication.
• T1071.001 Application Layer Protocol: Web Protocols — Use of web protocols for C2 communication.
• T1219 Remote Access Software — Use of remote access software for C2.
• T1572 Protocol Tunneling — SSH dynamic SOCKS proxies (ssh -NfD 1080) for network pivoting. ProxyChains (Windows/Linux) tunneling attack tools through SOCKS5 proxies acquired from spam/malware affiliates.
• T1573 Encrypted Channel — Cloudflare Tunnels blend C2 with legitimate HTTPS traffic. Chisel-ng (Rust, SSH-over-WebSocket-over-TLS) for reverse tunnels. Velociraptor C2 over TLS with signed MSI beacons.

• T1486 Data Encrypted for Impact — Encryption of data for extortion.
• T1489 Service Stop — Stopping services to maximize impact.
• T1490 Inhibit System Recovery — Veeam backup jobs stopped and tape media long-erased (Erase-VBRTapeMedium -Long). Docker and QEMU VMs killed pre-encryption. vCenter used to reset ESXi root passwords. Database services (MySQL, PostgreSQL, MongoDB, Redis, MSSQL) stopped before encryption.
• T1491 Defacement — Data deleted from CRM web panels and databases. chmod -R 777 applied to NAS filesystems to facilitate locker access and destroy access controls.