Threat video1:00
Vexy Ransomware Albion Online Victim: Detection & IOCs
Vexy Ransomware claims 16 GB from Albion Online Data Project, unverified. Its 9 detection rules and 10 IOCs include a free Splunk SPL rule.
Read the full threat intel for Vexy Ransomware Albion Online Victim: Detection & IOCs →
Chapters
- 0:00The hookVexy claims 16-GB exfiltrated from a community platform.
- 0:05The storyIt publishes market prices for Albion Online.
- 0:12Attack pathReportedly, 16-GB was exfiltrated.
- 0:25AttributionAttributed to Vexy Ransomware.
- 0:31Indicators of compromise3 indicators to hunt: 2 domains and 1 URL.
- 0:37MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to impact.
- 0:42Remediation4 steps now: Reset credentials and invalidate sessions and cookies for all accounts.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Vexy claims 16-GB exfiltrated from a community platform.
0:06It publishes market prices for Albion Online.
0:09The claim is unverified.
0:12Reportedly, 16-GB was exfiltrated.
0:15Vexy listed it on its leak site.
0:18No leak links were listed at discovery.
0:26Attributed to Vexy Ransomware. Confidence: medium.
0:313 indicators to hunt: 2 domains and 1 URL.
0:378 ATT&CK techniques, from initial access to impact.
0:424 steps now: Reset credentials and invalidate sessions and cookies for all accounts.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.