Read on Twitter
🧵New #CTI assessment based on OSINT research:
🔎ScatteredSpider/0ktapus is a BlackCat (ALPHV) affiliate, but doesn't deploy ransomware
- Based on some temporal, technical, and behavioral analysis
Follow me 🐇🕳 (1/6)
🔎ScatteredSpider/0ktapus is a BlackCat (ALPHV) affiliate, but doesn't deploy ransomware
- Based on some temporal, technical, and behavioral analysis
Follow me 🐇🕳 (1/6)
9 Feb 23, Reddit faced a 'highly-targeted phishing attack' & had docs and source code stolen
TTPs are very similar to ScatteredSpider/0ktapus campaigns:
- a landing page impersonating its intranet site
- stolen employees' credentials and 2FA codes
reddit.com/r/reddit/comme… (2/6)
TTPs are very similar to ScatteredSpider/0ktapus campaigns:
- a landing page impersonating its intranet site
- stolen employees' credentials and 2FA codes
reddit.com/r/reddit/comme… (2/6)
22 May 23, Trend Micro revealed that a BlackCat affiliate used an identical Microsoft-signed POORTRY sample (909f3fc221acbe999483c87d9ead024a) used by UNC3944 (ScatteredSpider/0ktapus), which Trend says they have used since February 2023 (3/6)
https://twitter.com/BushidoToken/status/1660615718545547268
16 June 23, the BlackCat data leak site adds 'The Reddit Files', TA says they 'broke into Reddit on February 5, 2023'.
The 'Reddit Files' was written in clear English, different to BlackCat leaks, as well as other Russia-based group, like CL0P (4/6)
The 'Reddit Files' was written in clear English, different to BlackCat leaks, as well as other Russia-based group, like CL0P (4/6)
https://twitter.com/vxunderground/status/1670208418160820225/
Overlaps 🔎
- ⌚ Temporal: The Reddit breach took place at the same time as the BlackCat post says
- ⚙ Technical: Reuse of the TTPs (SMS/SSO phish) and same tools (the POORTRY driver)
- 🕵️♂️ Behavioral: Data-theft-extortion operations, English-speaking threat actors
(5/6)
- ⌚ Temporal: The Reddit breach took place at the same time as the BlackCat post says
- ⚙ Technical: Reuse of the TTPs (SMS/SSO phish) and same tools (the POORTRY driver)
- 🕵️♂️ Behavioral: Data-theft-extortion operations, English-speaking threat actors
(5/6)
There's still *much* to uncover about the relationship between ScatteredSpider/0ktapus and BlackCat (ALPHV) but these public reports do indicate various connections. 🕷🐈⬛
More English-speaking threat actors working with Russia-based ransomware groups is a noteworthy trend. (6/6)
More English-speaking threat actors working with Russia-based ransomware groups is a noteworthy trend. (6/6)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
