Ransomwarehigh
Head Mare hacktivists: attacks on companies in Russia and Belarus
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion | 7.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.80.91.107 | 45.87.246[.]169 June 26, 2024 212165 45.87.245[.]30 – 57494 185.80.91[.]107 July 10, 2024 212165 91.219.151[.]47 May 02, 2024 56694 5 |
| ipv4 | 188.127.237.46 | t of servers we observed in attacks: IP First detection ASN 188.127.237[.]46 March 31, 2022 56694 45.87.246[.]169 June 26, 2024 212165 |
| ipv4 | 45.11.27.232 | hantomCore sample establishes a connection with another C2 (45.11.27[.]232) and checks the host’s domain using the WinAPI function N |
| ipv4 | 45.87.245.30 | 6 March 31, 2022 56694 45.87.246[.]169 June 26, 2024 212165 45.87.245[.]30 – 57494 185.80.91[.]107 July 10, 2024 212165 91.219.151[. |
| ipv4 | 45.87.246.169 | P First detection ASN 188.127.237[.]46 March 31, 2022 56694 45.87.246[.]169 June 26, 2024 212165 45.87.245[.]30 – 57494 185.80.91[.]1 |
| ipv4 | 5.252.176.47 | tomatically established a connection with the attackers’ C2 5.252.176[.]47: PhantomCore C2 connection We observed the following comm |
| ipv4 | 5.252.176.77 | 5 91.219.151[.]47 May 02, 2024 56694 5.252.176[.]47 – 39798 5.252.176[.]77 October 29, 2023 39798 Various utilities used at differen |
| ipv4 | 5.252.178.92 | e sample, after execution, establishes a connection with C2 5.252.178[.]92: PhantomCore C2 connection During our research, we also f |
| ipv4 | 91.219.151.47 | image above, the PhantomDL sample connects to the C2 server 91.219.151[.]47 through port 80 and performs domain identification using |
| sha256 | 015a6855e016e07ee1525bfb6510050443ad5482039143f4986c0e2ab8638343 | C29ABD674ED8C3411268C35E96B4F5A30FABE1AE2E8765A82291DB8F921 015A6855E016E07EE1525BFB6510050443AD5482039143F4986C0E2AB8638343 9D056138CFB8FF80B0AA53F187D5A576705BD7954D36066EBBBF34A4432 |
| sha256 | 053ba35452ee2ea5dca9df9e337a3f307374462077a731e53e6cc62eb82517bd | A549E3B95614DEE580F73A63D75272D0FBA8CA1AD6E93D99E44B9F95CAA 053BA35452EE2EA5DCA9DF9E337A3F307374462077A731E53E6CC62EB82517BD 2F9B3C29ABD674ED8C3411268C35E96B4F5A30FABE1AE2E8765A82291DB |
| sha256 | 08dc76d561ba2f707da534c455495a13b52f65427636c771d445de9b10293470 | 80C3BD739920716397547A8C0E152F51976229836E7442CF7F83ACFDC69 08DC76D561BA2F707DA534C455495A13B52F65427636C771D445DE9B10293470 6A889F52AF3D94E3F340AFE63615AF4176AB9B0B248490274B10F96BA4E |
| sha256 | 201f8dd57bce6fd70a0e1242b07a17f489c5f873278475af2eaf82a751c24fa8 | publication but may become outdated in the future. Hashes: 201F8DD57BCE6FD70A0E1242B07A17F489C5F873278475AF2EAF82A751C24FA8 9F5B780C3BD739920716397547A8C0E152F51976229836E7442CF7F83AC |
| sha256 | 22898920df011f48f81e27546fece06a4d84bce9cde9f8099aa6a067513191f3 | 138CFB8FF80B0AA53F187D5A576705BD7954D36066EBBBF34A44326C546 22898920DF011F48F81E27546FECE06A4D84BCE9CDE9F8099AA6A067513191F3 2F1EE997A75F17303ACC1D5A796C26F939EB63871271F0AD9761CDBD592 |
| sha256 | 2d3db0ff10edd28ee75b7cf39fcf42e9dd51a6867eb5962e8dc1a51d6a5bac50 | 953296131D0A8E67D70AEEA8FA5AE04FD52F43F8F917145F2EE19F30271 2D3DB0FF10EDD28EE75B7CF39FCF42E9DD51A6867EB5962E8DC1A51D6A5BAC50 DC47D49D63737D12D92FBC74907CD3277739C6C4F00AAA7C7EB561E7342 |
| sha256 | 2f1ee997a75f17303acc1d5a796c26f939eb63871271f0ad9761cdbd592e7569 | 920DF011F48F81E27546FECE06A4D84BCE9CDE9F8099AA6A067513191F3 2F1EE997A75F17303ACC1D5A796C26F939EB63871271F0AD9761CDBD592E7569 AF5A650BF2B3A211C39DCDCAB5F6A5E0F3AF72E25252E6C0A66595F4B43 |
| sha256 | 2f9b3c29abd674ed8c3411268c35e96b4f5a30fabe1ae2e8765a82291db8f921 | 35452EE2EA5DCA9DF9E337A3F307374462077A731E53E6CC62EB82517BD 2F9B3C29ABD674ED8C3411268C35E96B4F5A30FABE1AE2E8765A82291DB8F921 015A6855E016E07EE1525BFB6510050443AD5482039143F4986C0E2AB86 |
| sha256 | 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86 | 8F2D9F553CC1ACFB370BCFA2CCF5DE78A11697365CF8646704646E89A38 311EDF744C2E90D7BFC550C893478F43D1D7977694D5DCECF219795F3EB99B86 4C218953296131D0A8E67D70AEEA8FA5AE04FD52F43F8F917145F2EE19F |
| sha256 | 33786d781d9c492e17c56dc5fae5350b94e9722830d697c3cbd74098ea891e5a | F52AF3D94E3F340AFE63615AF4176AB9B0B248490274B10F96BA4EDB263 33786D781D9C492E17C56DC5FAE5350B94E9722830D697C3CBD74098EA891E5A 5D924A9AB2774120C4D45A386272287997FD7E6708BE47FB93A4CAD271F |
| sha256 | 4c218953296131d0a8e67d70aeea8fa5ae04fd52f43f8f917145f2ee19f30271 | F744C2E90D7BFC550C893478F43D1D7977694D5DCECF219795F3EB99B86 4C218953296131D0A8E67D70AEEA8FA5AE04FD52F43F8F917145F2EE19F30271 2D3DB0FF10EDD28EE75B7CF39FCF42E9DD51A6867EB5962E8DC1A51D6A5 |
| sha256 | 5a3c5c165d0070304fe2d2a5371f5f6fdd1b5c964ea4f9d41a672382991499c9 | 340E716C6812A12396BCD4624B8CFB06835F88479FA6CFDE6861015C9E0 5A3C5C165D0070304FE2D2A5371F5F6FDD1B5C964EA4F9D41A672382991499C9 DC3E4A549E3B95614DEE580F73A63D75272D0FBA8CA1AD6E93D99E44B9F |
| sha256 | 5d924a9ab2774120c4d45a386272287997fd7e6708be47fb93a4cad271f32a03 | D781D9C492E17C56DC5FAE5350B94E9722830D697C3CBD74098EA891E5A 5D924A9AB2774120C4D45A386272287997FD7E6708BE47FB93A4CAD271F32A03 9B005340E716C6812A12396BCD4624B8CFB06835F88479FA6CFDE686101 |
| sha256 | 664b68f2d9f553cc1acfb370bcfa2ccf5de78a11697365cf8646704646e89a38 | FAAAB2175DC501D73E814663058C78C0A042675A8937266357BCFB96C50 664B68F2D9F553CC1ACFB370BCFA2CCF5DE78A11697365CF8646704646E89A38 311EDF744C2E90D7BFC550C893478F43D1D7977694D5DCECF219795F3EB |
| sha256 | 6a889f52af3d94e3f340afe63615af4176ab9b0b248490274b10f96ba4edb263 | 6D561BA2F707DA534C455495A13B52F65427636C771D445DE9B10293470 6A889F52AF3D94E3F340AFE63615AF4176AB9B0B248490274B10F96BA4EDB263 33786D781D9C492E17C56DC5FAE5350B94E9722830D697C3CBD74098EA8 |
| sha256 | 92804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50 | EF3F429DAE0AC69C38C18E8BDBFD82170E396200579B6B0EFF4C8B9A984 92804FAAAB2175DC501D73E814663058C78C0A042675A8937266357BCFB96C50 664B68F2D9F553CC1ACFB370BCFA2CCF5DE78A11697365CF8646704646E |
| sha256 | 9b005340e716c6812a12396bcd4624b8cfb06835f88479fa6cfde6861015c9e0 | A9AB2774120C4D45A386272287997FD7E6708BE47FB93A4CAD271F32A03 9B005340E716C6812A12396BCD4624B8CFB06835F88479FA6CFDE6861015C9E0 5A3C5C165D0070304FE2D2A5371F5F6FDD1B5C964EA4F9D41A672382991 |
| sha256 | 9d056138cfb8ff80b0aa53f187d5a576705bd7954d36066ebbbf34a44326c546 | 855E016E07EE1525BFB6510050443AD5482039143F4986C0E2AB8638343 9D056138CFB8FF80B0AA53F187D5A576705BD7954D36066EBBBF34A44326C546 22898920DF011F48F81E27546FECE06A4D84BCE9CDE9F8099AA6A067513 |
| sha256 | 9e9fabba5790d4843d2e5b027ba7af148b9f6e7fcde3fb6bddc661dba9ccb836 | 50BF2B3A211C39DCDCAB5F6A5E0F3AF72E25252E6C0A66595F4B4377F0F 9E9FABBA5790D4843D2E5B027BA7AF148B9F6E7FCDE3FB6BDDC661DBA9CCB836 B8447EF3F429DAE0AC69C38C18E8BDBFD82170E396200579B6B0EFF4C8B |
| sha256 | 9f5b780c3bd739920716397547a8c0e152f51976229836e7442cf7f83acfdc69 | DD57BCE6FD70A0E1242B07A17F489C5F873278475AF2EAF82A751C24FA8 9F5B780C3BD739920716397547A8C0E152F51976229836E7442CF7F83ACFDC69 08DC76D561BA2F707DA534C455495A13B52F65427636C771D445DE9B102 |
| sha256 | af5a650bf2b3a211c39dcdcab5f6a5e0f3af72e25252e6c0a66595f4b4377f0f | 997A75F17303ACC1D5A796C26F939EB63871271F0AD9761CDBD592E7569 AF5A650BF2B3A211C39DCDCAB5F6A5E0F3AF72E25252E6C0A66595F4B4377F0F 9E9FABBA5790D4843D2E5B027BA7AF148B9F6E7FCDE3FB6BDDC661DBA9C |
| sha256 | b8447ef3f429dae0ac69c38c18e8bdbfd82170e396200579b6b0eff4c8b9a984 | BBA5790D4843D2E5B027BA7AF148B9F6E7FCDE3FB6BDDC661DBA9CCB836 B8447EF3F429DAE0AC69C38C18E8BDBFD82170E396200579B6B0EFF4C8B9A984 92804FAAAB2175DC501D73E814663058C78C0A042675A8937266357BCFB |
| sha256 | dc3e4a549e3b95614dee580f73a63d75272d0fba8ca1ad6e93d99e44b9f95caa | C165D0070304FE2D2A5371F5F6FDD1B5C964EA4F9D41A672382991499C9 DC3E4A549E3B95614DEE580F73A63D75272D0FBA8CA1AD6E93D99E44B9F95CAA 053BA35452EE2EA5DCA9DF9E337A3F307374462077A731E53E6CC62EB82 |
| sha256 | dc47d49d63737d12d92fbc74907cd3277739c6c4f00aaa7c7eb561e7342ed65e | 0FF10EDD28EE75B7CF39FCF42E9DD51A6867EB5962E8DC1A51D6A5BAC50 DC47D49D63737D12D92FBC74907CD3277739C6C4F00AAA7C7EB561E7342ED65E EDA18761F3F6822C13CD7BEAE5AF2ED77A9B4F1DC7A71DF6AB715E7949B |
| sha256 | eda18761f3f6822c13cd7beae5af2ed77a9b4f1dc7a71df6ab715e7949b8c78b | 49D63737D12D92FBC74907CD3277739C6C4F00AAA7C7EB561E7342ED65E EDA18761F3F6822C13CD7BEAE5AF2ED77A9B4F1DC7A71DF6AB715E7949B8C78B File… |
| url | https://github.com/flozz/p0wny-shell | hell is called p0wny@shell:~# and is available on GitHub at hxxps://github[.]com/flozz/p0wny-shell. LEGISLATIVE_COUSIN.exe Sliver implant. Connects to 5.252 |
| url | https://github.com/rasta-mouse/Sherlock/tree/master | ties for local privilege escalation, available on GitHub at hxxps://github[.]com/rasta-mouse/Sherlock/tree/master. ngrok.exe ngrok utility. reverse.exe Meterpreter. Connec |
From the original article
11 min read at securelist.com
Head Mare is a hacktivist group that first made itself known in 2023 on the social network X (formerly Twitter) [1] . In their public posts, the attackers reveal information about some of their victims, including organization names, internal documents stolen during attacks, and screenshots of desktops and administrative consoles.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.