Threat video1:00
Vexy Ransomware Hits Living Word Schools: Detection & IOCs
Vexy Ransomware claims Living Word Schools, a US school, as a victim; the page lists 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for Vexy Ransomware Hits Living Word Schools: Detection & IOCs →
Chapters
- 0:00The hookMedium severity ransomware: 2 indicators.
- 0:05The storyThe listing was discovered.
- 0:12Attack pathExfiltrate data to operators.
- 0:26AttributionAttributed to Vexy Ransomware.
- 0:31Indicators of compromise2 indicators to hunt: 2 domains.
- 0:37MITRE ATT&CK techniques9 ATT&CK techniques, from initial access to impact.
- 0:42Remediation3 steps now: Reset credentials and invalidate sessions for the student and administration.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Medium severity ransomware: 2 indicators.
0:05The listing was discovered.
0:07The listing therefore does not establish how access was obtained.
0:12Exfiltrate data to operators.
0:15List victim on leak site.
0:26Attributed to Vexy Ransomware. Confidence: low.
0:312 indicators to hunt: 2 domains.
0:379 ATT&CK techniques, from initial access to impact.
0:423 steps now: Reset credentials and invalidate sessions for the student and administration.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.