Ransomware needs a way in. Stolen credentials are the cheapest one.
obscura Ransomware Group
Ransomware group profile
Description
Obscura is a sophisticated threat group known for its diverse tactics and wide-ranging targets. They operate across various sectors, employing advanced techniques to compromise systems and extract sensitive data. Their activities have significant implications for affected organizations, often resulting in financial and operational disruption.
Key insights
- •Utilizes phishing and social engineering for initial access.
- •Targets a wide array of sectors including construction, real estate, and public administration.
- •Employs ransomware and data exfiltration tactics to maximize impact.
- •Operates internationally, with notable activity in both Europe and North America.
- •Engages in supply chain attacks to infiltrate organizations indirectly.
- •Adapts quickly to changes in security measures, demonstrating high resilience.
Threat Level & Status Breakdown
For obscura · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for obscura in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for obscura
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
- c00a2d757349bfff4d7e0665446101d2ab46a1734308cb3704f93d20dc7aac23
- eae09889399fe4fb8e78b114dba0527de913d12fb1802944a88ed136e3e90577
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for obscura
T1486
T1486
T1490
T1490
T1078
T1078
T1021
T1021
T1562
T1562
T1059
T1059
T1547
T1547
T1021.001
T1021.001
T1106
T1106
T1203
T1203
T1012
T1012
T1080
T1080
Victims(19)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Thai Petroleum & Trading Co., Ltd. | Thailand | Claimed | 8 months ago | |
| REDtone | Malaysia | Claimed | 8 months ago | |
| บริษัท เอสทีซี คอนกรีตโปรดัคท์ จำกัด (มหาชน) | Thailand | Claimed | 8 months ago | |
| [Redacted] #1927 | Thailand | Claimed | 8 months ago | |
| Revoil | Greece | Claimed | 8 months ago | |
| Trend Import Export | Romania | Claimed | 8 months ago | |
| CleverPower | Denmark | Claimed | 8 months ago | |
| FBI | United States | Claimed | 9 months ago | |
| StanleyCo Malaysia | Malaysia | Claimed | 9 months ago | |
| STARTEK | Taiwan | Claimed | 9 months ago | |
| ACE Forwarding | United States | Claimed | 9 months ago | |
| NEW TOYO INT'L HOLDINGS LTD | Singapore | Data Leaked | 11 months ago | |
| Thompson Dorfman Sweatman LLP | Canada | Data Leaked | 11 months ago | |
| Federal Auto Holdings Berhad | Malaysia | Data Leaked | 11 months ago | |
| Cape Dara Resort | Thailand | Data Leaked | 11 months ago | |
| eastdesign.com.my | Malaysia | Claimed | 12 months ago | |
| City of Michigan City Indiana | United States | Data Leaked | 11 months ago | |
| EAST Design Architect Sdn. Bhd | Malaysia | Claimed | 12 months ago | |
| Espectral | Portugal | Claimed | 12 months ago |
Affected countries(23)
Countries where this group has been reported to target or leak victims.