Threat video1:00
BYOD Ransomware Vanderbilt Breach: Detection & IOCs
BYOD claims it encrypted Vanderbilt databases and stole over 1M SSNs, unconfirmed. Track it with 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for BYOD Ransomware Vanderbilt Breach: Detection & IOCs →
Chapters
- 0:00The hookBYOD lists Vanderbilt among about 17 victims.
- 0:04The storyVanderbilt told users to shut devices down.
- 0:12Attack pathBYOD claims it took over the domain controller.
- 0:25AttributionAttributed to BYOD.
- 0:30Indicators of compromise3 indicators to hunt: 1 domain, 1 file name and 1 hosting.
- 0:36MITRE ATT&CK techniques4 ATT&CK techniques, from persistence to impact.
- 0:41Remediation5 steps now: Hunt for README_BYOD_31.txt ransom notes on endpoints and file shares.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00BYOD lists Vanderbilt among about 17 victims.
0:05Vanderbilt told users to shut devices down.
0:08BYOD claims it encrypted databases.
0:12BYOD claims it took over the domain controller.
0:15It claims encrypted databases.
0:18A ransom note links to its leak site.
0:20Listed on a Tor leak site, same day.
0:26Attributed to BYOD. Confidence: medium.
0:303 indicators to hunt: 1 domain, 1 file name and 1 hosting.
0:364 ATT&CK techniques, from persistence to impact.
0:415 steps now: Hunt for README_BYOD_31.txt ransom notes on endpoints and file shares.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.