Threat video1:00
Vexy Ransomware Upper Web Brazil Leak: Detection & IOCs
Vexy Ransomware's leak-site claim against Upper Web, a Brazilian agency, is unverified. Covered by 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Vexy Ransomware Upper Web Brazil Leak: Detection & IOCs →
Chapters
- 0:00The hookVexy claims Upper Web, a Brazilian agency.
- 0:05The storyPosted on a leak site in November.
- 0:11Attack pathPer the report, access was likely remote.
- 0:25AttributionAttributed to Vexy Ransomware.
- 0:30Indicators of compromise5 indicators to hunt: 2 IPs and 3 domains.
- 0:37MITRE ATT&CK techniques6 ATT&CK techniques, from execution to impact.
- 0:42Remediation4 steps now: Verify the Upper Web listing with the victim and preserve.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Vexy claims Upper Web, a Brazilian agency.
0:05Posted on a leak site in November.
0:07It is not independently verified.
0:12Per the report, access was likely remote.
0:14Data was staged in archives.
0:16Then the victim was posted on the leak blog.
0:19Then samples are released in stages.
0:26Attributed to Vexy Ransomware. Confidence: low.
0:315 indicators to hunt: 2 IPs and 3 domains.
0:376 ATT&CK techniques, from execution to impact.
0:424 steps now: Verify the Upper Web listing with the victim and preserve.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.