Product
high
advisory
Plain Text Passwords: A Direct Path to Organizational Compromise
2 rules 4 TTPs 2 IOCsA threat actor, after gaining initial access via a SonicWall VPN vulnerability, exploited plain text Huntress portal recovery codes found on a security engineer's desktop to infiltrate the security platform, enabling defense evasion and furthering malicious activity.
SonicWall VPNs +1
credential-theft
defense-evasion
ransomware
plain-text-passwords
initial-access
security-platform-compromise
2r
4t
2i
high
threat
Ransomware-as-a-Service (RaaS) Ecosystem: Affiliate Tradecraft and Initial Access Vectors
2 rules 1 TTPRansomware-as-a-service (RaaS) attacks leverage affiliates for initial access, persistence, and exfiltration, using varied techniques like compromised RDP, vulnerable VPNs, and rogue RMM tools, impacting multiple organizations in a single campaign.
Remote Desktop Protocol +7
ransomware
raas
initial-access
persistence
2r
1t