Threat video1:00
WhiteArmor Trojan Horse Access Sales: Detection & IOCs
WhiteArmor sells initial access to firms above $500M revenue and recruits insiders. Hunt it with 9 detection rules, 16 IOCs and a free Splunk SPL rule.
Read the full threat intel for WhiteArmor Trojan Horse Access Sales: Detection & IOCs →
Chapters
- 0:00The hookRansomware shifts to access sales, targets $500M+
- 0:05The storyVictims claimed since October.
- 0:11Attack pathVictims claimed; advertised access sales.
- 0:27AttributionAttributed to WhiteArmor.
- 0:31Indicators of compromise3 indicators to hunt: 2 domains and 1 URL.
- 0:37MITRE ATT&CK techniques5 ATT&CK techniques, from resource development to impact.
- 0:41Remediation4 steps now: Review Okta, Azure/Entra ID and cloud IAM root/privileged account sign-ins.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Ransomware shifts to access sales, targets $500M+
0:05Victims claimed since October.
0:07Then offered initial access to high-value targets.
0:12Victims claimed; advertised access sales.
0:15V-P-N, Jenkins, C-R-M, identity, or insider recruitment.
0:19Valid credentials enable login; then extort.
0:23Ransom in Bitcoin or Monero.
0:27Attributed to WhiteArmor. Confidence: medium.
0:323 indicators to hunt: 2 domains and 1 URL.
0:375 ATT&CK techniques, from resource development to impact.
0:424 steps now: Review Okta, Azure/Entra ID and cloud IAM root/privileged account sign-ins.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.