Threat video1:00
ActiveCloud Belarus Cloud Ransomware: Detection & IOCs
ActiveCloud's Belarusian cloud was encrypted, cutting hosting and SmartMail for days: 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for ActiveCloud Belarus Cloud Ransomware: Detection & IOCs →
Chapters
- 0:00The hookBelarusian cloud host went down since about 03:30.
- 0:04The storyCustomers lost hosting, email and support.
- 0:11Attack pathThe Record reported ransomware: it encrypted cloud parts.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise3 indicators to hunt: 3 URLs.
- 0:39MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to impact.
- 0:43Remediation10 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Belarusian cloud host went down since about 03:30.
0:05Customers lost hosting, email and support.
0:08By Friday, main services are restored.
0:11The Record reported ransomware: it encrypted cloud parts.
0:15Hosting, email and support went offline.
0:18Downstream sites like Domino's Belarus had outages.
0:22ActiveCloud disclosed it on Telegram.
0:24No evidence customer data was stolen.
0:29No threat actor is attributed. Confidence: low.
0:343 indicators to hunt: 3 URLs.
0:394 ATT&CK techniques, from initial access to impact.
0:4410 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.