{
  "name": "Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomware",
  "slug": "threat-assessment-repellent-scorpius-distributors-of-cicada3301-ransomware",
  "description": "Repellent Scorpius is a new ransomware-as-a-service group distributing Cicada3301 ransomware. It emerged in May 2024 and employs double extortion tactics involving data theft. The report covers a technical analysis of the Cicada3301 ransomware, the group's tactics, connections to historical incidents, and an updated encryptor variant. It anticipates increased Cicada3301 activity.",
  "published": "2024-09-11T06:08:08+00:00",
  "created_at": "2024-09-11T06:08:08+00:00",
  "modified_at": "2024-09-11T06:24:36+00:00",
  "created_at_opencti": "2024-09-11T06:08:08+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-09-11",
    "cicada3301",
    "cybercrime",
    "encryption",
    "exfiltration",
    "extortion",
    "ransomware"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "91.238.181.238"
      },
      {
        "id": "",
        "name": "103.42.240.37"
      },
      {
        "id": "",
        "name": "http://cicadabv7vicyvgz5khl7v2x5yygcgow7ryy6yppwmxii4eoobdaztqd.onion/"
      },
      {
        "id": "",
        "name": "8ec114b29c7f2406809337b6c68ab30b0b7f0d1647829d56125e84662b84ea74"
      },
      {
        "id": "",
        "name": "56e1d092c07322d9dad7d85d773953573cc3294b9e428b3bbbaf935ca4d2f7e7"
      },
      {
        "id": "",
        "name": "3969e1a88a063155a6f61b0ca1ac33114c1a39151f3c7dd019084abd30553eab"
      },
      {
        "id": "",
        "name": "2d73b3aefcfbb47c1a187ddee7a48a21af7c85eb49cbdcb665db07375e36dc33"
      },
      {
        "id": "",
        "name": "0260258f6f083aff71c7549a6364cb05d54dd27f40ca1145e064353dd2a9e983"
      }
    ],
    "malware": [
      {
        "id": "8d8a20de-fbf9-4338-90e4-dd5947c95240",
        "name": "Cicada3301",
        "slug": "cicada3301"
      }
    ],
    "intrusion_sets": [
      {
        "id": "a9fdef62-494c-484f-b81f-74ab5ecf8cfb",
        "name": "Repellent Scorpius",
        "slug": "repellent-scorpius"
      }
    ],
    "attack_patterns": [
      {
        "id": "e73b317e-ea92-49b4-a45d-051f7279aced",
        "name": "T1213"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "e9932d2a-834c-4b6f-8835-dce6c7d12b74",
        "name": "T1563"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2024-1709"
      },
      {
        "id": "",
        "name": "CVE-2024-1708"
      }
    ]
  },
  "external_refs": [
    "https://unit42.paloaltonetworks.com/repellent-scorpius-cicada3301-ransomware/",
    "https://otx.alienvault.com/pulse/66e14fe8e606bc88f19cf19b"
  ]
}