Threat video1:00
Vexy Ransomware Claims ZipAI Leak: Detection & IOCs
Vexy Ransomware's leak site claims 15.73 GB taken from ZipAI, a Vietnam AI platform. Detect it with 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Vexy Ransomware Claims ZipAI Leak: Detection & IOCs →
Chapters
- 0:00The hookVexy ransomware claims ZipAI: 15.73 GB.
- 0:05The storyVexy targeted ZipAI, extracted 15.73 GB.
- 0:13Attack pathLikely vector: infostealer-harvested credentials.
- 0:26AttributionAttributed to Vexy Ransomware.
- 0:31Indicators of compromise4 indicators to hunt: 2 domains and 2 URLs.
- 0:37MITRE ATT&CK techniques5 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation4 steps now: Reset credentials and revoke active sessions for accounts potentially exposed.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Vexy ransomware claims ZipAI: 15.73 GB.
0:06Vexy targeted ZipAI, extracted 15.73 GB.
0:11Demands negotiation.
0:14Likely vector: infostealer-harvested credentials.
0:17Bulk data exfiltrated to leak site.
0:20Ransom demands published by group.
0:27Attributed to Vexy Ransomware. Confidence: low.
0:314 indicators to hunt: 2 domains and 2 URLs.
0:375 ATT&CK techniques, from reconnaissance to impact.
0:424 steps now: Reset credentials and revoke active sessions for accounts potentially exposed.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.