Ransomware
Create a staging directory and generate a cryto key there. Discover the directories inside a user's home folder then
safely encrypt all files inside the directories using the generated key. Compress the staging directory to prepare the
crypto key for exfiltration and open a ransom note on the system.
TTPs
List directories in current users home folder
Create a staging directory
Create a crypto key
Archive exfiltration directory
Recursively encrypt a directory
Remove ransomed files from disk
Leave encrypted data recovery note
Tags
wizard spider, kaseya vsa attack, ransomwareOther chains in this theme
Stage and execute Cuba Ransomware.Is this host protected from LockBit?
Deploy a custom payload to achieve ransomware without using traditional encryption.
Deploy a custom payload to achieve ransomware without using traditional encryption.Deploy a Windows live-off-the-land ransomware attack.Deploy a linux live-off-the-land ransomware attack.
Is my host protected against Cuba Ransomware?
2022-12-27
Is this host protected from LockBit?
2022-12-06
CSwipe
2022-01-04
S(C)wipe
2021-12-28
Windows LotL Ransomware
2021-12-21
Linux LotL Ransomware
2021-12-14
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github