Blog
/
/
February 24, 2021

LockBit Ransomware Analysis: Compromised Credentials

Darktrace examines how a LockBit ransomware attack that took place over just four hours was caused by one compromised credential. Read more here.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
24
Feb 2021

Lockbit ransomware found

LockBit ransomware was recently identified by Darktrace's Cyber AI during a trial with a retail company in the US. After an initial foothold was established via a compromised administrative credential, internal reconnaissance, lateral movement, and encryption of files occurred simultaneously, allowing the ransomware to steamroll through the digital system in just a few hours.

This incident serves as the latest reminder that ransomware campaigns now move through organizations at a speed that far outpaces human responders, demonstrating the need for machine-speed Autonomous Response to contain the threat before damage is done.

Lockbit ransomware defined

First discovered in 2019, LockBit is a relatively new family of ransomware that quickly exploits commonly available protocols and tools like SMB and PowerShell. It was originally known as ‘ABCD’ due the filename extension of the encrypted files, before it started using the current .lockbit extension. Since those early beginnings, it has evolved into one of the most calamitous strains of malware to date, asking for an average ransom of around $40,000 per organization.

As cyber-criminals level up the speed and scale of their attacks, ransomware remains a critical concern for organizations across every industry. In the past 12 months, Darktrace has observed an increase of over 20% in ransomware incidents across its customer base. Attackers are constantly developing new threat variants targeting exploits, utilizing off-the-shelf tools, and profiting from the burgeoning Ransomware-as-a-Service (RaaS) business model.

How does LockBit work?

In a typical attack, a threat actor will spend days or weeks inside a system, manually screening for the best way to grind the victim’s business to a halt. This phase tends to expose multiple indicators of compromise such as command and control (C2) beaconing, which Darktrace AI identifies in real time.

LockBit, however, only requires the presence of a human for a number of hours, after which it propagates through a system and infects other hosts on its own, without the need for human oversight. Crucially, the malware performs reconnaissance and continues to spread during the encryption phase. This allows it to cause maximal damage faster than other manual approaches.

AI-powered defense is essential in fighting back against these machine-driven attacks, which have the capacity to spread at speed and scale, and often go undetected by signature-based security tools. Cyber AI augments human teams by not only detecting the subtle signs of a threat, but autonomously responding in seconds, quicker than any human can be expected to react.

Ransomware analysis: Breaking down a LockBit attack with AI

Figure 1: Timeline of attack on the infected host and the encryption host. The infected host was the device initially infected with LockBit, which then spread to the encryption host, the device which performed the encryption.

Initial compromise

The attack commenced when a cyber-criminal gained access to a single privileged credential – either through a brute-force attack on an externally facing device, as seen in previous LockBit ransomware attacks, or simply with a phishing email. With the use of this credential, the device was able to spread and encrypt files within hours of the initial infection.

Had the method of infiltration been via phishing attack, a route that has become increasingly popular in recent months, Darktrace/ EMAIL would have withheld the email and stripped the malicious payloads, and so prevented the attack from the outset.

Limiting permissions, the use of strong passwords, and multi-factor authentication (MFA), are critical in preventing the exploitation of standard network protocols in such attacks.

Internal reconnaissance

At 14:19 local time, the first of many WMI commands (ExecMethod) to multiple internal destinations was performed by an internal IP address over DCE-RPC. This series of commands occurred throughout the encryption process. Given these commands were unusual in the context of the normal ‘pattern of life’ for the organization, Darktrace DETECT alerted the security team to each of these connections.

Within three minutes, the device had started to write executable files over SMB to hidden shares on multiple destinations – many of which were the same. File writes to hidden shares are ordinarily restricted. However, the unauthorized use of an administrative credential granted these privileges. The executable files were written to the Windows / Temp directory. Filenames had a similar formatting: .*eck[0-9]?.exe

Darktrace identified each of these SMB writes as a potential threat, since such administrative activity was unexpected from the compromised device.

The WMI commands and executable file writes continued to be made to multiple destinations. In less than two hours, the ExecMethod command was delivered to a critical device – the ‘encryption host’ – shortly followed by an executable file write (eck3.exe) to its hidden c$ share.

LockBit’s script has the capability to check its current privileges and, if non-administrative, it attempts to bypass using Windows User Account Control (UAC). This particular host did provide the required privileges to the process. Once this device was infected, encryption began.

File encryption

Only one second after encryption had started, Darktrace alerted on the unusual file extension appendage in addition to the previous, high-fidelity alerts for earlier stages of the attack lifecycle.

A recovery file – ‘Restore-My-Files.txt’ – was identified by Darktrace one second after the first encryption event. 8,998 recovery files were written, one to each encrypted folder.

An example of Darktrace’s Threat Visualizer showcasing anomalous SMB connections, with model breaches represented by dots.
Figure 2: An example of Darktrace’s Threat Visualizer showcasing anomalous SMB connections, with model breaches represented by dots.

The encryption host was a critical device that regularly utilized SMB. Exploiting SMB is a popular tactic for cyber-criminals. Such tools are so frequently used that it is difficult for signature-based detection methods to identify quickly whether their activity is malicious or not. In this case, Darktrace’s ‘Unusual Activity’ score for the device was elevated within two seconds of the first encryption, indicating that the device was deviating from its usual pattern of behavior.

Throughout the encryption process, Darktrace also detected the device performing network reconnaissance, enumerating shares on 55 devices (via srvsvc) and scanning over 1,000 internal IP addresses on nine critical TCP ports.

During this time, ‘Patient Zero’ – the initially infected device – continued to write executable files to hidden file shares. LockBit was using the initial device to spread the malware across the digital estate, while the ‘encryption host’ performed reconnaissance and encrypted the files simultaneously.

Despite Cyber AI detecting the threat even before the encryption had begun, the security team did not have eyes on Darktrace at the time of the attack. The intrusion was thus allowed to continue and over 300,000 files were encrypted and appended with the .lockbit extension. Four servers and 15 desktop devices were affected, before the attack was stopped by the administrators.

The rise of ‘hit and run’ ransomware

While most ransomware resides inside an organization for days or weeks, LockBit’s self-governing nature allows the attacker to ‘hit and run’, deploying the ransomware with minimal interaction required after the initial intrusion. The ability to detect anomalous activity across the entire digital infrastructure in real time is therefore crucial in LockBit’s prevention.

WMI and SMB are relied upon by the vast majority of companies around the world, and yet they were utilized in this attack to propagate through the system and encrypt hundreds of thousands of files. The prevalence and volume of these connections make them near-impossible to monitor with humans or signature-based detection techniques alone.

Moreover, the uniqueness of every enterprise’s digital estate impedes signature-based detection from effectively alerting on internal connections and the volume of such connections. Darktrace, however, uses machine learning to understand the individual pattern of behavior for each device, in this case allowing it to highlight the unusual internal activity as it occurred.

The organization involved did not have Darktrace’s Autonomous Response technology configured in active mode. If enabled, i would have surgically blocked the initial WMI operations and SMB drive writes that triggered the attack whilst allowing the critical network devices to continue standard operations. Even if the foothold had been established, D would have enforced the ‘pattern of life’ of the encryption host, preventing the cascade of encryption over SMB. This demonstrates the importance of meeting machine-speed attacks with autonomous cyber security, which reacts in real time to sophisticated threats when human security teams cannot.

LockBit has the ability to encrypt thousands of files in just seconds, even when targeting well-prepared organizations. This type of ransomware, with built-in worm-like functionality, is expected to become increasingly common over 2021. Such attacks can move at a speed which no human security team alone can match. Darktrace’s approach, which uses unsupervised machine learning, can respond in seconds to these rapid attacks and shut them down in their earliest stages.

Thanks to Darktrace analyst Isabel Finn for her insights on the above threat find.

Darktrace model detections:

  • Device / New or Uncommon WMI Activity
  • Compliance / SMB Drive Write
  • Compromise / Ransomware / Suspicious SMB Activity
  • Compromise / Ransomware / Ransom or Offensive Words Written to SMB
  • Anomalous File / Internal / Additional Extension Appended to SMB File
  • Anomalous Connection / SMB Enumeration
  • Device / Network Scan – Low Anomaly Score
  • Anomalous Connection / Sustained MIME Type Conversion
  • Anomalous Connection / Suspicious Read Write Ratio
  • Unusual Activity / Sustained Anomalous SMB Activity
  • Device / Large Number of Model Breaches

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO

More in this series

No items found.

Blog

/

/

May 6, 2025

Combatting the Top Three Sources of Risk in the Cloud

woman working on laptopDefault blog imageDefault blog image

With cloud computing, organizations are storing data like intellectual property, trade secrets, Personally Identifiable Information (PII), proprietary code and statistics, and other sensitive information in the cloud. If this data were to be accessed by malicious actors, it could incur financial loss, reputational damage, legal liabilities, and business disruption.

Last year data breaches in solely public cloud deployments were the most expensive type of data breach, with an average of $5.17 million USD, a 13.1% increase from the year before.

So, as cloud usage continues to grow, the teams in charge of protecting these deployments must understand the associated cybersecurity risks.

What are cloud risks?

Cloud threats come in many forms, with one of the key types consisting of cloud risks. These arise from challenges in implementing and maintaining cloud infrastructure, which can expose the organization to potential damage, loss, and attacks.

There are three major types of cloud risks:

1. Misconfigurations

As organizations struggle with complex cloud environments, misconfiguration is one of the leading causes of cloud security incidents. These risks occur when cloud settings leave gaps between cloud security solutions and expose data and services to unauthorized access. If discovered by a threat actor, a misconfiguration can be exploited to allow infiltration, lateral movement, escalation, and damage.

With the scale and dynamism of cloud infrastructure and the complexity of hybrid and multi-cloud deployments, security teams face a major challenge in exerting the required visibility and control to identify misconfigurations before they are exploited.

Common causes of misconfiguration come from skill shortages, outdated practices, and manual workflows. For example, potential misconfigurations can occur around firewall zones, isolated file systems, and mount systems, which all require specialized skill to set up and diligent monitoring to maintain

2. Identity and Access Management (IAM) failures

IAM has only increased in importance with the rise of cloud computing and remote working. It allows security teams to control which users can and cannot access sensitive data, applications, and other resources.

Cybersecurity professionals ranked IAM skills as the second most important security skill to have, just behind general cloud and application security.

There are four parts to IAM: authentication, authorization, administration, and auditing and reporting. Within these, there are a lot of subcomponents as well, including but not limited to Single Sign-On (SSO), Two-Factor Authentication (2FA), Multi-Factor Authentication (MFA), and Role-Based Access Control (RBAC).

Security teams are faced with the challenge of allowing enough access for employees, contractors, vendors, and partners to complete their jobs while restricting enough to maintain security. They may struggle to track what users are doing across the cloud, apps, and on-premises servers.

When IAM is misconfigured, it increases the attack surface and can leave accounts with access to resources they do not need to perform their intended roles. This type of risk creates the possibility for threat actors or compromised accounts to gain access to sensitive company data and escalate privileges in cloud environments. It can also allow malicious insiders and users who accidentally violate data protection regulations to cause greater damage.

3. Cross-domain threats

The complexity of hybrid and cloud environments can be exploited by attacks that cross multiple domains, such as traditional network environments, identity systems, SaaS platforms, and cloud environments. These attacks are difficult to detect and mitigate, especially when a security posture is siloed or fragmented.  

Some attack types inherently involve multiple domains, like lateral movement and supply chain attacks, which target both on-premises and cloud networks.  

Challenges in securing against cross-domain threats often come from a lack of unified visibility. If a security team does not have unified visibility across the organization’s domains, gaps between various infrastructures and the teams that manage them can leave organizations vulnerable.

Adopting AI cybersecurity tools to reduce cloud risk

For security teams to defend against misconfigurations, IAM failures, and insecure APIs, they require a combination of enhanced visibility into cloud assets and architectures, better automation, and more advanced analytics. These capabilities can be achieved with AI-powered cybersecurity tools.

Such tools use AI and automation to help teams maintain a clear view of all their assets and activities and consistently enforce security policies.

Darktrace / CLOUD is a Cloud Detection and Response (CDR) solution that makes cloud security accessible to all security teams and SOCs by using AI to identify and correct misconfigurations and other cloud risks in public, hybrid, and multi-cloud environments.

It provides real-time, dynamic architectural modeling, which gives SecOps and DevOps teams a unified view of cloud infrastructures to enhance collaboration and reveal possible misconfigurations and other cloud risks. It continuously evaluates architecture changes and monitors real-time activity, providing audit-ready traceability and proactive risk management.

Real-time visibility into cloud assets and architectures built from network, configuration, and identity and access roles. In this unified view, Darktrace / CLOUD reveals possible misconfigurations and risk paths.
Figure 1: Real-time visibility into cloud assets and architectures built from network, configuration, and identity and access roles. In this unified view, Darktrace / CLOUD reveals possible misconfigurations and risk paths.

Darktrace / CLOUD also offers attack path modeling for the cloud. It can identify exposed assets and highlight internal attack paths to get a dynamic view of the riskiest paths across cloud environments, network environments, and between – enabling security teams to prioritize based on unique business risk and address gaps to prevent future attacks.  

Darktrace’s Self-Learning AI ensures continuous cloud resilience, helping teams move from reactive to proactive defense.

[related-resource]

Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance

Blog

/

/

May 2, 2025

SocGholish: From loader and C2 activity to RansomHub deployment

laptop and hand typingDefault blog imageDefault blog image

Over the past year, a clear pattern has emerged across the threat landscape: ransomware operations are increasingly relying on compartmentalized affiliate models. In these models, initial access brokers (IABs) [6], malware loaders, and post-exploitation operators work together.

Due to those specialization roles, a new generation of loader campaigns has risen. Threat actors increasingly employ loader operators to quietly establish footholds on the target network. These entities then hand off access to ransomware affiliates. One loader that continues to feature prominently in such campaigns is SocGholish.

What is SocGholish?

SocGholish is a loader malware that has been utilized since at least 2017 [7].  It has long been associated with fake browser updates and JavaScript-based delivery methods on infected websites.

Threat actors often target outdated or poorly secured CMS-based websites like WordPress. Through unpatched plugins, or even remote code execution flaws, they inject malicious JavaScript into the site’s HTML, templates or external JS resources [8].  Historically, SocGholish has functioned as a first-stage malware loader, ultimately leading to deployment of Cobalt Strike beacons [9], and further facilitating access persistence to corporate environments. More recently, multiple security vendors have reported that infections involving SocGholish frequently lead to the deployment of RansomHub ransomware [3] [5].

This blog explores multiple instances within Darktrace's customer base where SocGholish deployment led to subsequent network compromises. Investigations revealed indicators of compromise (IoCs) similar to those identified by external security researchers, along with variations in attacker behavior post-deployment. Key innovations in post-compromise activities include credential access tactics targeting authentication mechanisms, particularly through the abuse of legacy protocols like WebDAV and SCF file interactions over SMB.

Initial access and execution

Since January 2025, Darktrace’s Threat Research team observed multiple cases in which threat actors leveraged the SocGholish loader for initial access. Malicious actors commonly deliver SocGholish by compromising legitimate websites by injecting malicious scripts into the HTML of the affected site. When the visitor lands on an infected site, they are typically redirected to a fake browser update page, tricking them into downloading a ZIP file containing a JavaScript-based loader [1] [2]. In one case, a targeted user appears to have visited the compromised website garagebevents[.]com (IP: 35.203.175[.]30), from which around 10 MB of data was downloaded.

Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.
Figure 1: Device Event Log showing connections to the compromised website, following by connections to the identified Keitaro TDS instances.

Within milliseconds of the connection establishment, the user’s device initiated several HTTPS sessions over the destination port 443 to the external endpoint 176.53.147[.]97, linked to the following Keitaro TDS domains:

  • packedbrick[.]com
  • rednosehorse[.]com
  • blackshelter[.]org
  • blacksaltys[.]com

To evade detection, SocGholish uses highly obfuscated code and relies on traffic distribution systems (TDS) [3].  TDS is a tool used in digital and affiliate marketing to manage and distribute incoming web traffic based on predefined rules. More specifically, Keitaro is a premium self-hosted TDS frequently utilized by attackers as a payload repository for malicious scripts following redirects from compromised sites. In the previously noted example, it appears that the device connected to the compromised website, which then retrieved JavaScript code from the aforementioned Keitaro TDS domains. The script served by those instances led to connections to the endpoint virtual.urban-orthodontics[.]com (IP: 185.76.79[.]50), successfully completing SocGholish’s distribution.

Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.
Figure 2: Advanced Search showing connections to the compromised website, following by those to the identified Keitaro TDS instances.

Persistence

During some investigations, Darktrace researchers observed compromised devices initiating HTTPS connections to the endpoint files.pythonhosted[.]org (IP: 151.101.1[.]223), suggesting Python package downloads. External researchers have previously noted how attackers use Python-based backdoors to maintain access on compromised endpoints following initial access via SocGholish [5].

Credential access and lateral movement

Credential access – external

Darktrace researchers identified observed some variation in kill chain activities following initial access and foothold establishment. For example, Darktrace detected interesting variations in credential access techniques. In one such case, an affected device attempted to contact the rare external endpoint 161.35.56[.]33 using the Web Distributed Authoring and Versioning (WebDAV) protocol. WebDAV is an extension of the HTTP protocol that allows users to collaboratively edit and manage files on remote web servers. WebDAV enables remote shares to be mounted over HTTP or HTTPS, similar to how SMB operates, but using web-based protocols. Windows supports WebDAV natively, which means a UNC path pointing to an HTTP or HTTPS resource can trigger system-level behavior such as authentication.

In this specific case, the system initiated outbound connections using the ‘Microsoft-WebDAV-MiniRedir/10.0.19045’ user-agent, targeting the URI path of /s on the external endpoint 161.35.56[.]33. During these requests, the host attempted to initiate NTML authentication and even SMB sessions over the web, both of which failed. Despite the session failures, these attempts also indicate a form of forced authentication. Forced authentication exploits a default behavior in Windows where, upon encountering a UNC path, the system will automatically try to authenticate to the resource using NTML – often without any user interaction. Although no files were directly retrieved, the WebDAV server was still likely able to retrieve the user’s NTLM hash during the session establishment requests, which can later be used by the adversary to crack the password offline.

Credential access – internal

In another investigated incident, Darktrace observed a related technique utilized for credential access and lateral movement. This time, the infected host uploaded a file named ‘Thumbs.scf’ to multiple internal SMB network shares. Shell Command File ( SCF) is a legacy Windows file format used primarily for Windows Explorer shortcuts. These files contain instructions for rendering icons or triggering shell commands, and they can be executed implicitly when a user simply opens a folder containing the file – no clicks required.

The ‘Thumbs.scf’ file dropped by the attacker was crafted to exploit this behavior. Its contents included a [Shell] section with the Command=2 directive and an IconFile path pointing to a remote UNC resource on the same external endpoint, 161.35.56[.]33, seen in the previously described case – specifically, ‘\\161.35.56[.]33\share\icon.ico’. When a user on the internal network navigates to the folder containing the SCF file, their system will automatically attempt to load the icon. In doing so, the system issues a request to the specified UNC path, which again prompts Windows to initiate NTML authentication.

This pattern of activity implies that the attacker leveraged passive internal exposure; users who simply browsed a compromised share would unknowingly send their NTML hashes to an external attacker-controlled host. Unlike the WebDAV approach, which required initiating outbound communication from the infected host, this SCF method relies on internal users to interact with poisoned folders.

Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.
Figure 3: Contents of the file 'Thumbs.scf' showing the UNC resource hosted on the external endpoint.

Command-and-control

Following initial compromise, affected devices would then attempt outbound connections using the TLS/SSL protocol over port 443 to different sets of command-and-control (C2) infrastructure associated with SocGholish. The malware frequently uses obfuscated JavaScript loaders to initiate its infection chain, and once dropped, the malware communicates back to its infrastructure over standard web protocols, typically using HTTPS over port 443. However, this set of connections would precede a second set of outbound connections, this time to infrastructure linked to RansomHub affiliates, possibly facilitating the deployed Python-based backdoor.

Connectivity to RansomHub infrastructure relied on defense evasion tactics, such as port-hopping. The idea behind port-hopping is to disguise C2 traffic by avoiding consistent patterns that might be caught by firewalls, and intrusion detection systems. By cycling through ephemeral ports, the malware increases its chances of slipping past basic egress filtering or network monitoring rules that only scrutinize common web traffic ports like 443 or 80. Darktrace analysts identified systems connecting to destination ports such as 2308, 2311, 2313 and more – all on the same destination IP address associated with the RansomHub C2 environment.

Figure 4: Advanced Search connection logs showing connections over destination ports that change rapidly.

Conclusion

Since the beginning of 2025, Darktrace analysts identified a campaign whereby ransomware affiliates leveraged SocGholish to establish network access in victim environments. This activity enabled multiple sets of different post exploitation activity. Credential access played a key role, with affiliates abusing WebDAV and NTML over SMB to trigger authentication attempts. The attackers were also able to plant SCF files internally to expose NTML hashes from users browsing shared folders. These techniques evidently point to deliberate efforts at early lateral movement and foothold expansion before deploying ransomware. As ransomware groups continue to refine their playbooks and work more closely with sophisticated loaders, it becomes critical to track not just who is involved, but how access is being established, expanded, and weaponized.

Credit to Chrisina Kreza (Cyber Analyst) and Adam Potter (Senior Cyber Analyst)

Appendices

Darktrace / NETWORK model alerts

·       Anomalous Connection / SMB Enumeration

·       Anomalous Connection / Multiple Connections to New External TCP Port

·       Anomalous Connection / Multiple Failed Connections to Rare Endpoint

·       Anomalous Connection / New User Agent to IP Without Hostname

·       Compliance / External Windows Communication

·       Compliance / SMB Drive Write

·       Compromise / Large DNS Volume for Suspicious Domain

·       Compromise / Large Number of Suspicious Failed Connections

·       Device / Anonymous NTML Logins

·       Device / External Network Scan

·       Device / New or Uncommon SMB Named Pipe

·       Device / SMB Lateral Movement

·       Device / Suspicious SMB Activity

·       Unusual Activity / Unusual External Activity

·       User / Kerberos Username Brute Force

MITRE ATT&CK mapping

·       Credential Access – T1187 Forced Authentication

·       Credential Access – T1110 Brute Force

·       Command and Control – T1071.001 Web Protocols

·       Command and Control – T1571 Non-Standard Port

·       Discovery – T1083 File and Directory Discovery

·       Discovery – T1018 Remote System Discovery

·       Discovery – T1046 Network Service Discovery

·       Discovery – T1135 Network Share Discovery

·       Execution – T1059.007 JavaScript

·       Lateral Movement – T1021.002 SMB/Windows Admin Shares

·       Resource Deployment – T1608.004 Drive-By Target

List of indicators of compromise (IoCs)

·       garagebevents[.]com – 35.203.175[.]30 – Possibly compromised website

·       packedbrick[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       rednosehorse[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       blackshelter[.]org – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       blacksaltys[.]com – 176.53.147[.]97 – Keitaro TDS Domains used for SocGholish Delivery

·       virtual.urban-orthodontics[.]com – 185.76.79[.]50

·       msbdz.crm.bestintownpro[.]com – 166.88.182[.]126 – SocGholish C2

·       185.174.101[.]240 – RansomHub Python C2

·       185.174.101[.]69 – RansomHub Python C2

·       108.181.182[.]143 – RansomHub Python C2

References

[1] https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/socgholish-malware/

[2] https://intel471.com/blog/threat-hunting-case-study-socgholish

[3] https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html

[4] https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware

[5] https://www.guidepointsecurity.com/blog/ransomhub-affiliate-leverage-python-based-backdoor/

[6] https://www.cybereason.com/blog/how-do-initial-access-brokers-enable-ransomware-attacks

[7] https://attack.mitre.org/software/S1124/

[8] https://expel.com/blog/incident-report-spotting-socgholish-wordpress-injection/

[9] https://www.esentire.com/blog/socgholish-to-cobalt-strike-in-10-minutes

Continue reading
About the author
Christina Kreza
Cyber Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI