HiveV5_keystream_decryptor

HiveV5 keystream decryptor PoC Introduction The Hive sample analyzed and referred to in this document was randomly chosen from this list created by @rivitna to which my warmest thanks go. Artifacts are available on the VirusTotal platform. In this document, file a0h2uih3d2.exe has been taken as a...

Raccine

Raccine A Simple Ransomware Protection Why We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine. How it works We register a debugger for vssadmin.exe and wmic.exe,...

ThreatIntelligenceDiscordBot

Threat Intelligence Discord Bot The vx-underground Threat Intelligence Discord Bot gets updates from various clearnet domains, ransomware threat actor domains, and Telegram channels. This bot will check for updates in intervals of 1800 seconds omit Telegram bot, this is gotten in real time. Don't...

LockBit-Ransomware-Analysis

🔐 LockBit Ransomware Analysis – Citrix Bleed Exploitation 📌 Overview This project presents a detailed threat intelligence and incident response analysis of the October 2023 LockBit ransomware attack targeting Boeing. The attackers exploited CVE-2023-4966 Citrix Bleed to hijack NetScaler session...

ESXi-Ransomware-Scanner-mi

ESXiransomwarescanner A program that scans IP addresses for signs of ESXi compromise by grabbing the ransom note from an html page and comparing the strings. Requirements python 3.x requests BeautifulSoup tqdm colorama Installation Use the package manager pip to install the required packages...

fortra-goanywhere-mft-vulnerability-detection

Fortra GoAnywhere MFT Vulnerability Detection Nuclei templates for detecting Fortra GoAnywhere MFT vulnerabilities. Created by@rxerium Overview CVE detection templates for Fortra GoAnywhere Managed File Transfer MFT, including multiple CISA KEV vulnerabilities exploited by ransomware groups...

RansomLord

RansomLord NG v1.0 Anti-Ransomware exploit tool. Proof-of-concept tool that automates the creation of PE files, used to exploit ransomware pre-encryption. Updated version NG: https://github.com/malvuln/RansomLord/releases/tag/v1.0 Lang: C SHA256:...

EthernalBlue_report

EthernalBlue Report What is it? This is an exploit developed by the NSA, stolen by hacker group, primarily known for being used in ransomware attacks, such as WannaCry or NotPetya... Why did you make this report? I've been asked to do this report on the Tryhackme EthernalBlue room, but without...

GwisinMsi

GwisinMsi This repo contains the PoC of the MSI payload used in the blog post. The payload is based on the Gwisin ransomware's MSI payload analysis of the AhnLab ASEC team's blog post. DLL Compiling Configuration Project Project properties c/c++ preprocessor processor definition -...

LockBit-Tattoo

LockBit-Tattoo Electronic: ID: 272784 Joined: Jul 20, 2022 Male: BTC: 3HeNJmgecLNHEhVn3JMcboybTgiFx4DGe3 Media: photo2022-09-0822-15-38.jpg Female: BTC: 3HC5eCcYtW27jhD59mg4U3haWr36teiLXB Media: photo2022-09-1101-07-49.jpg photo2022-09-1101-07-54.jpg DegB2W: ID: 272203 Joined: Jul 16, 2022 Male:...

Malware

YARA rules, programs for ransomware families: Akira Babuk Beast BlackByte BlackCat ALPHV BlackMatter BlueLocker MemeCryptor Cerber Conti DarkBit DeadBolt Dharma Enmity GarrantyDecrypt GlobeImposter / NewBomani GoodMorning / SD HardBit Hive / Hunters International HsHarada / Rapture Hunters...

ESXi_ransomware_bitcoinWallets

Background https://blog.ovhcloud.com/ransomware-targeting-vmware-esxi/ https://twitter.com/ValeryMarchive/status/1621528499315150849 Ransomnote example: Victims so far Wallets used so far 1. 1N8v8sRa2RdYq4xUUwpEePFT34TMzesPUx 2. 15vx9oDSQTJuAoYCL1VwzVBDgKYexRHpyC 3...

ESXiArgs-Recover

ESXiArgs-Recover ESXiArgs-Recover is a tool to allow organizations to attempt recovery of virtual machines affected by the ESXiArgs ransomware attacks. CISA is aware that some organizations have reported success in recovering files without paying ransoms. CISA compiled this tool based on publicly...

IoC_Attack_ESXi_Feb_2023

IoCAttackESXiFeb2023 Collection of IoCs available and related to attacks on ESXi infrastructures that occurred as of Friday February 3, 2023. News Here are some references regarding the attack: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/...

ransomwatch

ransomwatch 👀 🦅 ransomwatch rastrea los sitios de extorsión utilizados por grupos de ransomware y muestra un feed agregado de reclamaciones por favor, utiliza la plantilla de issue al enviar nuevos grupos ⚠️ el contenido dentro deransomwatch.telemetry.ltd, posts.json, groups.json junto con los...

ransomwatch

ransomwatch 👀 🦅 ransomwatch trails the extortion sites used by ransomware groups and surfaces an aggregated feed of claims please use the issue template when submitting new groups ⚠️ content withinransomwatch.telemetry.ltd, posts.json, groups.json alongside the docs/ & source/ directories is...

KilledProcessCanary

Windows Killed Process Canary A Windows Service to detect if it has been shutdown and hibernate if multiple instances are. Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

CVE-2026-20131-Post-Incident-Written-Report

CVE-2026-20131-Post-Incident-Written-Report This post-incident report analyzes the exploitation of CVE-2026-20131, a critical zero-day unauthenticated Remote Code Execution RCE vulnerability in Cisco Secure Firewall Management Center FMC. The document covers the initial intrusion vector via Java...

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. "The...

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A JavaServer Pages JSP web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management PLM software, according to new findings from ReliaQuest. The cybersecurity company...