Ransomwarecritical
Black Kingdom ransomware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-11510 | Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
CVE-2021-26855+3 related CVEs | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 group max | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | mega.io | uilder, such as the hardcoded key or communication with the mega.io domain. Victims Based on our telemetry we could see only a |
| domain | yuuuuu44.com | a20443c4eb266318200e4d7927c163e0eaec4ede780a Domain: hxxp://yuuuuu44[.]com/vpn-service/$(f1)/crunchyroll-vpn YARA rules: 1 2 3 4 5 6 |
| sha256 | 0e7d0db29c7247ae97591751d3b6c0728aed0ec1b1f853b25fc84e75ae12b7b8 | on : hash . sha256 ( pe . rich_signature . clear_data ) == "0e7d0db29c7247ae97591751d3b6c0728aed0ec1b1f853b25fc84e75ae12b7b8" } Appendix II – MITRE ATT&CK Mapping This table contains a |
| sha256 | 815d7f9d732c4d1a70cec05433b8d4de75cba1ca9caabbbe4b8cde3f176cc670 | 3c5776ee1b61018eeb3408fa7fa7490915146078d65b95621315e8b4287 815d7f9d732c4d1a70cec05433b8d4de75cba1ca9caabbbe4b8cde3f176cc670 910fbfa8ef4ad7183c1b5bdd3c9fd1380e617ca0042b428873c48f71ddc |
| sha256 | 866b1f5c5edd9f01c5ba84d02e94ae7c1f9b2196af380eed1917e8fc21acbbdc | fa8ef4ad7183c1b5bdd3c9fd1380e617ca0042b428873c48f71ddc857db 866b1f5c5edd9f01c5ba84d02e94ae7c1f9b2196af380eed1917e8fc21acbbdc c25a5c14269c990c94a4a20443c4eb266318200e4d7927c163e0eaec4ed |
| sha256 | 910fbfa8ef4ad7183c1b5bdd3c9fd1380e617ca0042b428873c48f71ddc857db | f9d732c4d1a70cec05433b8d4de75cba1ca9caabbbe4b8cde3f176cc670 910fbfa8ef4ad7183c1b5bdd3c9fd1380e617ca0042b428873c48f71ddc857db 866b1f5c5edd9f01c5ba84d02e94ae7c1f9b2196af380eed1917e8fc21a |
| sha256 | a387c3c5776ee1b61018eeb3408fa7fa7490915146078d65b95621315e8b4287 | 4c73a50b2deca0401f97e4202337e522be3df629b3ef91e706488b64908 a387c3c5776ee1b61018eeb3408fa7fa7490915146078d65b95621315e8b4287 815d7f9d732c4d1a70cec05433b8d4de75cba1ca9caabbbe4b8cde3f176 |
| sha256 | b9dbdf11da3630f464b8daace88e11c374a642e5082850e9f10a1b09d69ff04f | irectly updated in the corresponding .ioc file. File Hashes b9dbdf11da3630f464b8daace88e11c374a642e5082850e9f10a1b09d69ff04f c4aa94c73a50b2deca0401f97e4202337e522be3df629b3ef91e706488b |
| sha256 | c25a5c14269c990c94a4a20443c4eb266318200e4d7927c163e0eaec4ede780a | f5c5edd9f01c5ba84d02e94ae7c1f9b2196af380eed1917e8fc21acbbdc c25a5c14269c990c94a4a20443c4eb266318200e4d7927c163e0eaec4ede780a Domain: hxxp://yuuuuu44[.]com/vpn-service/$(f1)/crunchyroll |
| sha256 | c4aa94c73a50b2deca0401f97e4202337e522be3df629b3ef91e706488b64908 | f11da3630f464b8daace88e11c374a642e5082850e9f10a1b09d69ff04f c4aa94c73a50b2deca0401f97e4202337e522be3df629b3ef91e706488b64908 a387c3c5776ee1b61018eeb3408fa7fa7490915146078d65b95621315e8 |
| url | http://mega.io | ls for sending the generated key to the third-party service hxxp://mega.io. If the connection is unsuccessful, the Black Kingdom encry |
| url | http://yuuuuu44.com/vpn-service/$(f1 | 90c94a4a20443c4eb266318200e4d7927c163e0eaec4ede780a Domain: hxxp://yuuuuu44[.]com/vpn-service/$(f1)/crunchyroll-vpn YARA rules: 1 2 3 4 5 6 7 8 9 10 11 12 1 |
From the original article
10 min read at securelist.com
Black Kingdom ransomware appeared on the scene back in 2019, but we observed some activity again in 2021. The ransomware was used by an unknown adversary for exploiting a Microsoft Exchange vulnerability (CVE-2021-27065). The complexity and sophistication of the Black Kingdom family cannot bear a comparison with other Ransomware-as-a-Service (RaaS) or Big Game Hunting (BGH) families.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.