Threat video1:00
Hawkmoth Anubis Ransomware via Lindnor: Detection & IOCs
Hawkmoth ran Anubis with a Lindnor backdoor and five BYOVD drivers. Its 29 IOCs, 13 ATT&CK techniques and 9 detection rules include a free Splunk SPL rule.
Read the full threat intel for Hawkmoth Anubis Ransomware via Lindnor: Detection & IOCs →
Chapters
- 0:00The hookAbout 13 security-disabling tools deployed.
- 0:04The storyBackdoor installed on SQL servers.
- 0:10Attack pathLindnor backdoor installed, profiles host, beacons C2.
- 0:24AttributionAttributed to Hawkmoth.
- 0:28Indicators of compromise26 indicators to hunt: 2 domains and 24 SHA-256 hashes.
- 0:35MITRE ATT&CK techniques13 ATT&CK techniques, from persistence to impact.
- 0:40Remediation4 steps now: Block the listed C2 domains msrcontrib[.]com and cfgsync-relay[.]eastus[.]cloudapp[.]azure[.]com at DNS.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 13 security-disabling tools deployed.
0:05Backdoor installed on SQL servers.
0:07Security disabling tools deployed.
0:10Lindnor backdoor installed, profiles host, beacons C2.
0:1413 security-disabling tools deployed.
0:17AnyDesk installed, configured for Safe Mode.
0:21Ransomware encryption blocked.
0:24Attributed to Hawkmoth. Confidence: medium.
0:2926 indicators to hunt: 2 domains and 24 SHA-256 hashes.
0:3613 ATT&CK techniques, from persistence to impact.
0:404 steps now: Block the listed C2 domains msrcontrib[.]com and cfgsync-relay[.]eastus[.]cloudapp[.]azure[.]com at DNS.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.