Skip to content
Threat Feed
Subscribe

Actor

Ryuk

2 briefs RSS
low threat

AdFind Active Directory Reconnaissance Activity

AdFind.exe, a legitimate Active Directory query tool, is commonly abused by threat actors such as Trickbot, Ryuk, Maze, and FIN6 for post-exploitation Active Directory reconnaissance, enabling enumeration of objects like computers, people, subnets, and domain information.

Active Directory Trickbot +3 adfind active-directory reconnaissance discovery windows
3r 5t
high threat

Windows Defender Disabled via Registry Modification

An attacker modifies the Windows Registry key 'DisableAntiSpyware' to disable Windows Defender, a technique commonly associated with Ryuk ransomware to evade defenses.

Windows Defender +3 Ryuk defense-evasion registry-modification ransomware windows
2r 1t