Threat video1:00
France Qilin & NoName057(16) Attacks: Detection & IOCs
Qilin and MedusaLocker hit French local government as NoName057(16) drives DDoS claims: 26 IOCs and 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for France Qilin & NoName057(16) Attacks: Detection & IOCs →
Chapters
- 0:00The hookAbout 17,800 items surge through France's underground.
- 0:05The storyRansomware syndicates target French municipalities.
- 0:12Attack pathPhishing or leaked credentials enable initial access.
- 0:28AttributionAttributed to NoName057.
- 0:33Indicators of compromise1 indicator to hunt: 1 domain.
- 0:39MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Stand up continuous infostealer-log and combolist monitoring against employee.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 17,800 items surge through France's underground.
0:06Ransomware syndicates target French municipalities.
0:09Credential markets fuel the threat surge.
0:13Phishing or leaked credentials enable initial access.
0:16WinRM and PsExec move laterally through systems.
0:20Stage data with WinRAR, encrypt systems.
0:24Extort via victim leak-site posting.
0:29Attributed to NoName057. Confidence: medium.
0:341 indicator to hunt: 1 domain.
0:3918 ATT&CK techniques, from initial access to impact.
0:434 steps now: Stand up continuous infostealer-log and combolist monitoring against employee.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.