Area
Malware reports
Parent threat
Execution, Persistence, Privilege Escalation, Command and Control, Exfiltration, Impact
Finding
https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
Industry reference
attack:T1048:Exfiltration Over Alternative Protocol
attack:T1567:Exfiltration Over Web Service
attack:T1573:Encrypted Channel
attack:T1071.001:Web Protocols
attack:T1053.003:Cron
attack:T1486:Data Encrypted for Impact
Malware reference
DarkSide
Actor reference
UNC2628
UNC2659
UNC2465
Component
Linux
Scenario
No response