Threat video1:00
Vexy Ransomware Franc-Oil Claim: Detection & IOCs
Vexy Ransomware claims Franc-Oil, a Nigerian marine services firm, and 200 MB of data. Get 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for Vexy Ransomware Franc-Oil Claim: Detection & IOCs →
Chapters
- 0:00The hookVexy claims 200 MB exfiltrated.
- 0:05The storyVexy listed Franc-Oil, a Nigerian marine services firm.
- 0:12Attack pathInitial access is not public.
- 0:26AttributionAttributed to Vexy Ransomware.
- 0:31Indicators of compromise2 indicators to hunt: 2 domains.
- 0:37MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to impact.
- 0:42Remediation5 steps now: Hunt for shadow copy deletion.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Vexy claims 200 MB exfiltrated.
0:05Vexy listed Franc-Oil, a Nigerian marine services firm.
0:09The claim remains unverified.
0:13Initial access is not public.
0:15The group claims 200 MB exfiltrated.
0:18The listing appears on its Tor blog.
0:20No victim or third party has confirmed it.
0:26Attributed to Vexy Ransomware. Confidence: low.
0:312 indicators to hunt: 2 domains.
0:3810 ATT&CK techniques, from initial access to impact.
0:435 steps now: Hunt for shadow copy deletion.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.