Threat video1:00
Vortex Ransomware Scripps Leak Claim: Detection & IOCs
Vortex claims a leak-site listing for Scripps covering patient PHI and staff records, with 12 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for Vortex Ransomware Scripps Leak Claim: Detection & IOCs →
Chapters
- 0:00The hookVortex claims 14 victims, Scripps among them.
- 0:05The storyVortex claims it holds patient records.
- 0:11Attack pathThe tracker reported one known Tor leak site.
- 0:25AttributionAttributed to Vortex.
- 0:30Indicators of compromise2 indicators to hunt: 1 domain and 1 URL.
- 0:37MITRE ATT&CK techniques4 ATT&CK techniques, from resource development to impact.
- 0:42Remediation9 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Vortex claims 14 victims, Scripps among them.
0:05Vortex claims it holds patient records.
0:07No victim confirmation has surfaced.
0:12The tracker reported one known Tor leak site.
0:14A claim needs stolen data and a leak site.
0:17Some entries show deadlines, and one says more tiers will release.
0:26Attributed to Vortex. Confidence: low.
0:312 indicators to hunt: 1 domain and 1 URL.
0:374 ATT&CK techniques, from resource development to impact.
0:429 remediation steps are listed, 4 of them immediate.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.