BlackBerry has identified a new type of malicious software written in the Go programming language as the operator of the PYSA ransomware campaign, which has been targeting education institutions across the United States and Canada.
INDUSTRIES:
TARGETED COUNTRIES:
MALWARE FAMILIES:
PYSA, Chashell, Chisel, Ekans, Mespinoza, ChaChi
ATT&CK IDS:
T1059.001 – PowerShell, T1059.003 – Windows Command Shell, T1569.002 – Service Execution, T1543.003 – Windows Service, T1027 – Obfuscated Files or Information, T1057 – Process Discovery, T1082 – System Information Discovery, T1572 – Protocol Tunneling, T1071.001 – Web Protocols, T1090.002 – External Proxy, T1001 – Data Obfuscation, T1008 – Fallback Channels, T1573.001 – Symmetric Cryptography, T1041 – Exfiltration Over C2 Channel, T1587.001 – Malware, T1583.001 – Domains
0 Comments