{
  "name": "From IcedID to Dagon Locker Ransomware in 29 Days",
  "slug": "from-icedid-to-dagon-locker-ransomware-in-29-days",
  "description": "This intrusion started in August 2023 with a phishing campaign that distributed IcedID malware. The phishing operation utilized the Prometheus Traffic Direction System (TDS) to deliver the malware and victims were directed to a fraudulent website, mimicking an Azure download portal.",
  "published": "2024-04-29T15:23:59+00:00",
  "created_at": "2024-04-29T15:23:59+00:00",
  "modified_at": "2024-05-01T21:05:43+00:00",
  "created_at_opencti": "2024-04-29T15:23:59+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "access token",
    "adfind",
    "anydesk",
    "aws collector",
    "cobalt strike",
    "discovery",
    "domain account",
    "encrypted",
    "icedid",
    "manipulation",
    "modify system",
    "powershell",
    "prometheustds",
    "rclone",
    "seatbelt",
    "sharefinder",
    "shell",
    "utility"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "87.251.67.168"
      },
      {
        "id": "",
        "name": "51.89.133.3"
      },
      {
        "id": "",
        "name": "45.15.161.97"
      },
      {
        "id": "",
        "name": "194.58.68.187"
      },
      {
        "id": "",
        "name": "159.89.124.188"
      },
      {
        "id": "",
        "name": "151.236.9.176"
      },
      {
        "id": "",
        "name": "151.236.9.166"
      },
      {
        "id": "",
        "name": "159.223.95.82"
      },
      {
        "id": "",
        "name": "143.110.245.38"
      },
      {
        "id": "",
        "name": "23.159.160.88"
      },
      {
        "id": "",
        "name": "http://87.251.67.168:443"
      },
      {
        "id": "",
        "name": "http://194.58.68.187:443"
      },
      {
        "id": "",
        "name": "http://159.89.124.188:443"
      },
      {
        "id": "",
        "name": "http://159.223.95.82:443"
      },
      {
        "id": "",
        "name": "http://151.236.9.176:443"
      },
      {
        "id": "",
        "name": "http://151.236.9.166:443"
      },
      {
        "id": "",
        "name": "http://143.110.245.38:443"
      },
      {
        "id": "",
        "name": "winupdate.us.to"
      },
      {
        "id": "",
        "name": "ultrascihictur.com"
      },
      {
        "id": "",
        "name": "rpgmagglader.com"
      },
      {
        "id": "",
        "name": "restohalto.site"
      },
      {
        "id": "",
        "name": "patricammote.com"
      },
      {
        "id": "",
        "name": "oopscokir.com"
      },
      {
        "id": "",
        "name": "moashraya.com"
      },
      {
        "id": "",
        "name": "magiraptoy.com"
      },
      {
        "id": "",
        "name": "fraktomaam.com"
      },
      {
        "id": "",
        "name": "ewacootili.com"
      },
      {
        "id": "",
        "name": "f6e5dbff14ef272ce07743887a16decbee2607f512ff2a9045415c8e0c05dbb4"
      },
      {
        "id": "",
        "name": "a0191a300263167506b9b5d99575c4049a778d1a8ded71dcb8072e87f5f0bbcf"
      },
      {
        "id": "",
        "name": "9da84133ed36960523e3c332189eca71ca42d847e2e79b78d182da8da4546830"
      },
      {
        "id": "",
        "name": "839cf7905dc3337bebe7f8ba127961e6cd40c52ec3a1e09084c9c1ccd202418e"
      },
      {
        "id": "",
        "name": "65edf9bc2c15ef125ff58ac597125b040c487640860d84eea93b9ef6b5bb8ca6"
      },
      {
        "id": "",
        "name": "332afc80371187881ef9a6f80e5c244b44af746b20342b8722f7b56b61604953"
      }
    ],
    "malware": [
      {
        "id": "dd9b4e0f-d393-4859-848f-b88656f0e9a1",
        "name": "IcedID",
        "slug": "icedid"
      },
      {
        "id": "906be30f-e4ec-4634-a6de-9c31d0234628",
        "name": "Cobalt Strike",
        "slug": "cobalt-strike"
      }
    ],
    "attack_patterns": [
      {
        "id": "6b5f1e68-aec7-4ea0-9777-62156da790a7",
        "name": "T1069"
      },
      {
        "id": "a1de6d30-7fd6-4352-8f6c-d9904347f33f",
        "name": "T1039"
      },
      {
        "id": "d5c953ff-b143-41b6-bf2d-87b829132ea5",
        "name": "T1135"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "a15721d2-76b1-4869-bd1f-819afb6e368d",
        "name": "T1482"
      },
      {
        "id": "a58c2bff-7d90-4816-93fd-aa0b6beca12e",
        "name": "T1124"
      },
      {
        "id": "19ce62bb-3faf-4d09-90b1-d82fce1ba8b0",
        "name": "T1136"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      },
      {
        "id": "3e753709-1776-42f4-b465-278cb5f6ea6b",
        "name": "T1614"
      },
      {
        "id": "3245033a-53c4-454c-873a-fb653af0bf8a",
        "name": "T1552"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "a831f7c4-a7f0-4243-8211-1cd44fa34fa7",
        "name": "T1020"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "14da8ebf-e0b0-4d4e-9c83-56277980f266",
        "name": "T1134"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "31d29704-da1c-47ea-b93f-76d368813bdf",
        "name": "T1560"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/",
    "https://otx.alienvault.com/pulse/662fd7af0f52921e75d889de"
  ]
}