Hunt / payload
payload
18victims, 90d
Nov 3last post
1reports about them
14/17techniques with a rule
12indicators
Who they hit
| Posted | Victim | Country |
|---|---|---|
| 2026-11-03 | Stahlbau Mann GmbH | DE |
| 2026-10-31 | Straze Garden Center | ?? |
| 2026-10-31 | Kraft Lernen | DE |
| 2026-10-31 | SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) | DE |
| 2026-10-28 | Hauhinco | DE |
| 2026-10-28 | Marbre Design | FR |
| 2026-10-26 | Glückauf-Vermessung GmbH | DE |
| 2026-10-26 | Miletic GmbH | DE |
| 2026-10-26 | Edelstahl-Mechanik GmbH | DE |
| 2026-10-20 | BW Office World | ?? |
| 2026-10-20 | Brüninghoff Group | DE |
| 2026-10-08 | Boullard Musique | CH |
Latest 12 of 18, from ransomware.live. These are the group's claims.
Reports about them
- 2026-09-21 Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
What they do
17 techniques, in kill-chain order. 3 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.
| ID | Technique | SigmaHQ | Status |
|---|---|---|---|
| T1078 | Valid Accounts | 55 | SigmaHQ |
| T1078.002 | Domain Accounts | 5 | SigmaHQ |
| T1133 | External Remote Services | 20 | SigmaHQ |
| T1068 | Exploitation for Privilege Escalation | 30 | SigmaHQ |
| T1484.001 | Group Policy Modification | 6 | SigmaHQ |
| T1005 | Data from Local System | 14 | SigmaHQ |
| T1071 | Application Layer Protocol | 7 | SigmaHQ |
| T1489 | Service Stop | 20 | SigmaHQ |
| T1490 | Inhibit System Recovery | 27 | SigmaHQ |
| T1491.001 | Internal Defacement | 4 | SigmaHQ |
| T1531 | Account Access Removal | 9 | SigmaHQ |
| T1070.001 | T1070.001 | ~20 | close only |
| T1562.001 | T1562.001 | nothing | |
| T1562.004 | T1562.004 | nothing | |
| T1685 | Disable or Modify Tools | 162 | SigmaHQ |
| T1685.005 | Clear Windows Event Logs | 8 | SigmaHQ |
| T1686 | Disable or Modify System Firewall | 7 | SigmaHQ |
SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.
Sweep
12 ipv4. iocs.csv · package.json
| Type | Value | From |
|---|---|---|
| ipv4 | 104.164.55.46 | Kaspersky Securelist |
| ipv4 | 104.28.162.228 | Kaspersky Securelist |
| ipv4 | 104.28.163.162 | Kaspersky Securelist |
| ipv4 | 146.70.117.239 | Kaspersky Securelist |
| ipv4 | 149.102.229.154 | Kaspersky Securelist |
| ipv4 | 192.42.116.12 | Kaspersky Securelist |
| ipv4 | 192.42.116.50 | Kaspersky Securelist |
| ipv4 | 192.42.116.52 | Kaspersky Securelist |
| ipv4 | 192.42.116.56 | Kaspersky Securelist |
| ipv4 | 192.42.116.97 | Kaspersky Securelist |
| ipv4 | 37.19.210.12 | Kaspersky Securelist |
| ipv4 | 64.190.76.14 | Kaspersky Securelist |