2020-12-03:🔥 And ... [Major Discovery] 🤖"Persist, Brick, Profit -#TrickBot Offers New “#TrickBoot” UEFI-Focused Functionality"

🆕*First* Time Crimeware Group Pursued UEFI Firmware Exploitation | #YARA+IOCs in MISP JSON/CSV

@eclypsium | @IntelAdvanced
advanced-intel.com/post/persist-b… 📚:

1⃣TrickBoot is only one line of code away from being able to brick any device it finds to be vulnerable.
2⃣Historically, TrickBot actors have needed to evade and persist at the OS level - now a chance at UEFI level.
3⃣Actors are going lower in the stack to avoid detection.

2019-11-20: [Emerging] #Ransomware Crippling Rouen University Hospital France🇫🇷 |
#Clop #CryptoMix Variant
Linked Previously to #TA505 Actor Group [1]
Ref (h/t @malwrhunterteam): ->

https://twitter.com/malwrhunterteam/status/1197084962895347712

[1]

https://twitter.com/VK_Intel/status/1195027342348967936

🕯️Tracking Since Early 2019 on my Git @malwrhunterteam 💡This is probably the most solid connection to the Clop ransomware operation (".clop") to this lockdown.

✅Previous earlier samples and decoding scripts from malware resources ->
github.com/k-vitali/crypt…