-=TWELVE=- is back

Group -=TWELVE=- linked to Russian-Ukrainian conflict, active in attacking Russian government organizations, employs encryption and data deletion, exfiltrates data, shares similarities with DARKSTAR ransomware group, uses Unified Kill Chain, relies on reconnaissance techniques, uses well-known and freely available tools, gains initial access through valid credentials and VPN/SSH certificates, moves laterally using Remote Desktop Protocol (RDP), targets victim's contractors for initial access, employs web shells for exploitation