Wasted Locker Goes "Big-Game Hunting" in 2020
Summary: Cisco Talos describes a threat actor using the WastedLocker ransomware family, which delivers and activates ransomware across many systems in a corporate network at once to maximize damage and raise ransom demands into the hundreds of thousands of dollars. The actor uses dual-use tools including Cobalt Strike, Mimikatz, Empire and PowerSploit for lateral movement, with initial compromise tied to fake Google Chrome updates delivered via drive-by downloads from compromised websites.
Bottom line: The adversary cleared entire local security event logs with wevtutil.exe and disabled endpoint security software on systems it controlled, so the evidence a responder would need is gone before the ransom note appears.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- How adversaries use politics for compromise Cyber Risks ·