Ingress an encoded Pneuma DLL with the ServiceCrtMain function exported
Tactic: Command-and-control
Download and stage a base64 encoded 32-bit Pnuema DLL on the target system.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsSide-load an agent using components of the REvil ransomware attack kill chain.
Kaseya VSA Attack
2021-08-16
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github