{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/e-crime/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["persistence","linux","e-crime","cloud-native","lotl"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries frequently target the Linux ~/.ssh/authorized_keys file to establish persistent access to compromised endpoints. By injecting their own public keys into this file, attackers can bypass standard authentication mechanisms and maintain long-term unauthorized access to the system. This technique is often observed as part of broader campaigns involving Living off the Land (LotL) binaries, as well as specific threat activities attributed to malware like Hellcat Ransomware and VoidLink. Defenders must monitor process execution telemetry for common command-line tools interacting with these configuration files to identify potential persistence creation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful modification of authorized_keys allows an attacker to maintain persistent, high-privilege access to the target host. This unauthorized access can lead to lateral movement, further exploitation, or long-term data exfiltration. The technique is a common component of modern Linux-based threats, including those linked to ransomware operations and cloud-native malware deployments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize detection engineering efforts to monitor process execution paths targeting SSH configuration files.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule below to monitor for process activity interacting with authorized_keys files.\u003c/li\u003e\n\u003cli\u003eImplement filtering to exclude benign system administration activity, such as legitimate key management scripts utilizing 'echo' or 'ssh-keygen'.\u003c/li\u003e\n\u003cli\u003eConfigure Sysmon for Linux (Event ID 1) to capture full process command lines and parent process information.\u003c/li\u003e\n\u003cli\u003eUse the provided drilldown search logic to investigate specific users and destinations associated with detected key modifications.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:51:36Z","date_published":"2026-10-12T17:51:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-ssh-key-modification/","summary":"Adversaries modify SSH authorized_keys files on Linux systems to establish persistent access and bypass authentication, a technique detectable through process execution monitoring.","title":"Detection of Linux SSH Authorized Keys Modification","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-ssh-key-modification/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["data-destruction","impact","linux","e-crime"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis threat brief focuses on the malicious abuse of the standard Linux 'dd' utility to perform unauthorized file overwriting. Adversaries leverage this command to irreversibly destroy target files or entire partitions, significantly impacting system availability and recovery capabilities. This technique is often associated with data destruction campaigns, such as those observed in the Industroyer2 ecosystem. Defenders must monitor process execution logs for 'dd' commands containing output redirection flags ('of=') that target sensitive system files or data directories. This activity is a high-confidence indicator of destructive intent when observed outside of legitimate administrative maintenance windows.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe abuse of the 'dd' command for file destruction can render a Linux system inoperable, resulting in critical data loss and extended downtime. Successful execution of these commands effectively deletes or corrupts files, requiring complete system re-imaging or restoration from secure offline backups, which may not be readily available for all impacted sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect process execution of 'dd' with output redirection flags.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon for Linux or equivalent EDR telemetry to capture full command-line arguments for all executed processes.\u003c/li\u003e\n\u003cli\u003eEstablish a baseline of authorized administrative tasks to identify and filter out legitimate usage of 'dd' by system operators.\u003c/li\u003e\n\u003cli\u003eMonitor for suspicious process parent-child relationships where 'dd' is spawned by unexpected shell processes or web services.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:50:21Z","date_published":"2026-10-12T17:50:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-dd-overwrite/","summary":"Adversaries use the Linux 'dd' utility to perform destructive file overwriting, leading to data loss and system service disruption.","title":"Detection of Malicious File Overwriting via Linux dd Command","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-dd-overwrite/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["high"],"_cs_tags":["impact","ransomware","windows","e-crime"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe unauthorized deletion of Volume Shadow Copies is a prevalent technique used by ransomware operators and advanced persistent threat (APT) actors to hinder incident response and system restoration efforts. By leveraging legitimate, pre-installed Windows utilities such as vssadmin.exe and wmic.exe, attackers can effectively destroy local backups of files. This behavior is a hallmark of numerous ransomware families, including LockBit, Clop, Black Basta, Rhysida, and others. Security teams should monitor for the execution of these utilities with specific command-line arguments involving the deletion of shadow storage. Because these tools are also used by system administrators for legitimate maintenance, it is essential to baseline environment-specific behaviors to differentiate malicious activity from standard management tasks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established on the Windows host via spearphishing, exploit, or credential abuse.\u003c/li\u003e\n\u003cli\u003eThe attacker gains sufficient privileges to interact with system management utilities.\u003c/li\u003e\n\u003cli\u003eThe attacker executes a discovery phase to locate existing volume shadow copies.\u003c/li\u003e\n\u003cli\u003eThe attacker invokes vssadmin.exe or wmic.exe with specific parameters to target the shadow storage.\u003c/li\u003e\n\u003cli\u003eThe utility processes the deletion command, effectively purging backup snapshots from the disk.\u003c/li\u003e\n\u003cli\u003eThe attacker may then proceed to encrypt files, overwrite data, or deploy secondary payloads.\u003c/li\u003e\n\u003cli\u003eThe final objective is reached when the victim is unable to restore data from local snapshots, increasing pressure to pay a ransom.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful deletion of shadow copies eliminates the ability for victims to perform simple, local restoration of encrypted or stolen data. This activity is frequently the precursor to a broader ransomware event, leading to significant operational disruption, data loss, and exfiltration. This TTP has been observed across various sectors and is a standard component of major ransomware operations, often occurring just before the encryption phase of an attack.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to detect the usage of vssadmin.exe and wmic.exe for shadow copy deletion.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon process-creation logging (Event ID 1) or Windows Security event logging (Event ID 4688) to capture complete command-line arguments.\u003c/li\u003e\n\u003cli\u003eConfigure SIEM alerts to trigger specifically on process executions where the command line contains both 'delete' and 'shadow' keywords.\u003c/li\u003e\n\u003cli\u003eInvestigate occurrences of this activity to determine if the deletion was performed by a known administrator or an unauthorized process, especially if the parent process is unexpected.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:38:57Z","date_published":"2026-10-12T17:38:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-shadow-copy-deletion/","summary":"Detection of unauthorized deletion of Volume Shadow Copies using native Windows utilities vssadmin.exe or wmic.exe, a common technique employed by ransomware actors to prevent system recovery.","title":"Detection of Shadow Copy Deletion via System Utilities","url":"https://feed.craftedsignal.io/briefs/2026-10-shadow-copy-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - E-Crime","version":"https://jsonfeed.org/version/1.1"}