frag

Key insights

• •Targets primarily include organizations with vulnerabilities in Veeam Backup & Replication software.
• •Employs modular ransomware payloads customized for each attack to enhance stealth.
• •Leverages tactics from past ransomware groups like Hive and LockBit with novel evasion techniques.
• •Does not use countdown timers on their data leak site, setting them apart from other ransomware groups.
• •Initial access often gained through spear-phishing, exploitation of vulnerabilities, and stolen credentials.
• •Demands for ransom typically start in the low six-figure range, escalating to millions.
• •Uses Living Off The Land binaries for operations to avoid detection.