{
  "name": "The Anatomy of Abyss Locker Ransomware Attack",
  "slug": "the-anatomy-of-abyss-locker-ransomware-attack",
  "description": "Abyss Locker (AKA Abyss ransomware) is a relatively new threat group that emerged in 2023, specializing in swift and decisive intrusions designed to cripple victims with ransomware. Abyss Locker was active throughout 2024, causing multiple incidents investigated by Sygnia. However, no recent technical blogs provide detailed insights into the group\u2019s modus operandi.",
  "published": "2025-02-10T19:51:34+00:00",
  "created_at": "2025-02-10T19:51:34+00:00",
  "modified_at": "2025-02-10T19:58:55+00:00",
  "created_at_opencti": "2025-02-10T19:51:34+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-02-10",
    "abyss locker",
    "backdoor",
    "chisel",
    "defender",
    "esxi",
    "file",
    "impact",
    "locker",
    "patch",
    "persistence",
    "psexec",
    "ransomware",
    "rclone",
    "remcom",
    "restrict",
    "service",
    "smbexec",
    "ssh tunneling",
    "story",
    "strong",
    "velvet",
    "vulnerable"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "67.217.228.101"
      },
      {
        "id": "",
        "name": "64.95.12.70"
      },
      {
        "id": "",
        "name": "64.95.12.57"
      },
      {
        "id": "",
        "name": "149.137.142.15"
      },
      {
        "id": "",
        "name": "139.180.135.191"
      },
      {
        "id": "",
        "name": "f9ab649acfe76d6ac088461b471e5d981bdc8b71d940e94c63bc1988a2ed4678"
      },
      {
        "id": "",
        "name": "d48c7f13db60ef615e59773c442485e84acef09343375d0d8a462b285e959baa"
      },
      {
        "id": "",
        "name": "cd9d88cccd85209966c5a35aba7751b962bcc021a4216d6addfc0c3462ce80da"
      },
      {
        "id": "",
        "name": "6042a84529958a04a2d46384139da3ef016bf9498e791cd5e34dfecec2baa1d2"
      },
      {
        "id": "",
        "name": "5fba25759423f9efc92592977f6c9ff77d47a20aa8ec8e9cd17d5cfa786a1852"
      },
      {
        "id": "",
        "name": "5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2"
      },
      {
        "id": "",
        "name": "0d9089efe2a28630bc21d8db451ec14dc856c2d40444292c42e7cca218c7029e"
      },
      {
        "id": "",
        "name": "05b82d46ad331cc16bdc00de5c6332c1ef818df8ceefcd49c726553209b3a0da"
      },
      {
        "id": "",
        "name": "d76c74fc7a00a939985ae515991b80afa0524bf0a4feaec3e5e58e52630bd717"
      },
      {
        "id": "",
        "name": "3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71"
      }
    ],
    "malware": [
      {
        "id": "68a3d947-d46d-488f-b69f-ecc67212d2f9",
        "name": "Abyss Locker",
        "slug": "abyss-locker"
      }
    ],
    "attack_patterns": [
      {
        "id": "a1de6d30-7fd6-4352-8f6c-d9904347f33f",
        "name": "T1039"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "19ce62bb-3faf-4d09-90b1-d82fce1ba8b0",
        "name": "T1136"
      },
      {
        "id": "a2ba5594-6293-4868-928c-ab4b31927a02",
        "name": "T1572"
      },
      {
        "id": "6660b66c-3909-4927-a22f-c6d2b806b06a",
        "name": "T1530"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      },
      {
        "id": "1e1b6cb4-44b5-4e17-b267-bcb104acb1d4",
        "name": "T1546"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "4cb4ee3b-b78f-45cf-bcaa-45a2aa968e56",
        "name": "T1570"
      },
      {
        "id": "af9ed2e3-4663-4723-beab-c606ddc312e0",
        "name": "T1543"
      },
      {
        "id": "53c193a7-f726-4bd2-ae88-4019e2604adf",
        "name": "T1046"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "64cdebc9-0fb4-48f2-bf4f-b87f3741f664",
        "name": "T1068"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      }
    ]
  },
  "external_refs": [
    "https://www.sygnia.co/blog/abyss-locker-ransomware-attack-analysis/",
    "https://otx.alienvault.com/pulse/67aa66d6dee5419a88a0d61e"
  ]
}