Ransomware needs a way in. Stolen credentials are the cheapest one.
radar Ransomware Group
Ransomware group profile
Description
Dispossessor is a ransomware group that emerged in August 2023, gaining notoriety for targeting various sectors with sophisticated tactics. They specialize in a double extortion strategy, encrypting victims' data and threatening to leak it unless ransom is paid. Their aggressive approach includes direct contact with victims and the use of advanced malware.
Key insights
- •Uses double extortion tactics with threats of data leakage.
- •Employs spear-phishing as an initial attack vector.
- •Targets sectors like healthcare and construction, especially during crises.
- •Utilizes custom ransomware such as Babyk for file encryption.
- •Exploits supply chain vulnerabilities to increase impact.
- •Adopts techniques such as living-off-the-land binaries to evade detection.
Threat Level & Status Breakdown
For radar · Based on incidents in selected period
Status Breakdown
No recent activity in the selected period.
Intelligence
IOCs, YARA/Sigma rules, and related families for radar
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
- eae09889399fe4fb8e78b114dba0527de913d12fb1802944a88ed136e3e90577
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for radar
T1486
T1486
T1490
T1490
T1080
T1080
T1078
T1078
T1562
T1562
T1059
T1059
T1021
T1021
T1021.001
T1021.001
T1547
T1547
T1037
T1037
T1003
T1003
Victims(11)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Bentley Capital Ventures | United States | Claimed | 5 months ago | |
| TUAN LE Construction Company Limited | Vietnam | Claimed | 10 months ago | |
| Fouad Alghanim & Sons Group of Companies | Kuwait | Claimed | 11 months ago | |
| OpenEyes Technologies Inc. | United States | Claimed | 11 months ago | |
| MapQuest | United States | Claimed | 12 months ago | |
| MC INVERSIONES INMOBILIARIAS | Peru | Claimed | 12 months ago | |
| Congo Mineral services | Democratic Republic of the Congo | Claimed | 12 months ago | |
| Sold Real Estate | Australia | Claimed | 12 months ago | |
| One Agency Eastlakes | Australia | Claimed | 12 months ago | |
| UrbanX PTY LTD | Australia | Claimed | 12 months ago | |
| Chek Tan and Company | United States | Claimed | 12 months ago |
Affected countries(50)
Countries where this group has been reported to target or leak victims.