{"type": "bundle", "spec_version": "2.0", "id": "bundle--c6027b8a-9ffa-48ef-af27-336857995405", "objects": [{"type": "identity", "id": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Talos", "identity_class": "organization"}, {"type": "report", "id": "report--b3bad8fc-4ee5-4bbf-a367-f80b7d1e0016", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "New BYOVD loader behind DeadLock ransomware attack", "published": "2025-12-09T11:16:53Z", "object_refs": ["observed-data--7aef6384-1d37-49b4-be86-2eca729402cf", "indicator--88ce6502-3acd-4269-a8d5-424262ec634c", "indicator--7e4a01e3-f30f-4b22-bf19-5cf596851573", "indicator--97a27a18-509b-486a-8d95-7e97aa2db009", "indicator--edd6ce77-291c-4d4c-9a21-91869cecc061", "indicator--06667167-c513-4d56-8d84-a5f9e2e7b9ff", "attack-pattern--767dbf9e-df3f-45cb-8998-4903ab5f80c0", "attack-pattern--e3a12395-188d-4051-9a16-ea8e14d07b88", "attack-pattern--5372c5fe-f424-4def-bcd5-d3a8e770f07b", "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4", "attack-pattern--4061e78c-1284-44b4-9116-73e4ac3912f7", "attack-pattern--eb062747-2193-45de-8fa2-e62549c37ddf", "attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4", "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579", "attack-pattern--b80d107d-fa0d-4b60-9684-b0433e8bdba0"], "labels": ["Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", " Ransomware", " TLP:WHITE", "Exploiting Known Vulnerabilities", "Talos_Intel_Blog"]}, {"type": "observed-data", "id": "observed-data--7aef6384-1d37-49b4-be86-2eca729402cf", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2025-12-04T10:02:08.000Z", "modified": "2025-12-04T10:02:08.000Z", "first_observed": "2025-12-04T10:02:08Z", "last_observed": "2025-12-04T10:02:08Z", "number_observed": 1, "objects": {"0": {"type": "url", "value": "https://blog.talosintelligence.com/new-BYOVD-Deadlock-ransomware/"}}, "labels": ["misp:type=\"url\"", "misp:category=\"External analysis\""]}, {"type": "indicator", "id": "indicator--88ce6502-3acd-4269-a8d5-424262ec634c", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2025-12-04T10:05:19.000Z", "modified": "2025-12-04T10:05:19.000Z", "description": "EDRKiller tool", "pattern": "[file:hashes.SHA256 = '2d89fb7455ff3ebf6b965d8b1113857607f7fbda4c752ccb591dbc1dc14ba0da']", "valid_from": "2025-12-04T10:05:19Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--7e4a01e3-f30f-4b22-bf19-5cf596851573", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2025-12-04T10:05:19.000Z", "modified": "2025-12-04T10:05:19.000Z", "description": "Vulnerable driver (Targeted vulnerability CVE-2024-51324)", "pattern": "[file:hashes.SHA256 = '47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428']", "valid_from": "2025-12-04T10:05:19Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--97a27a18-509b-486a-8d95-7e97aa2db009", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2025-12-04T10:05:19.000Z", "modified": "2025-12-04T10:05:19.000Z", "description": "PowerShell evader script", "pattern": "[file:hashes.SHA256 = 'be1037fac396cf54fb9e25c48e5b0039b3911bb8426cbf52c9433ba06c0685ce']", "valid_from": "2025-12-04T10:05:19Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--edd6ce77-291c-4d4c-9a21-91869cecc061", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2025-12-04T10:05:19.000Z", "modified": "2025-12-04T10:05:19.000Z", "description": "DeadLock ransomware", "pattern": "[file:hashes.SHA256 = '3cd5703d285ed2753434f14f8da933010ecfdc1e5009d0e438188aaf85501612']", "valid_from": "2025-12-04T10:05:19Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "indicator", "id": "indicator--06667167-c513-4d56-8d84-a5f9e2e7b9ff", "created_by_ref": "identity--5df15c12-89fc-45a7-9620-0044ac110004", "created": "2025-12-04T10:05:19.000Z", "modified": "2025-12-04T10:05:19.000Z", "description": "DeadLock ransomware", "pattern": "[file:hashes.SHA256 = '3c1b9df801b9abbb3684670822f367b5b8cda566b749f457821b6481606995b3']", "valid_from": "2025-12-04T10:05:19Z", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "Payload delivery"}], "labels": ["misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\""]}, {"type": "attack-pattern", "id": "attack-pattern--767dbf9e-df3f-45cb-8998-4903ab5f80c0", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Domain Trust Discovery - T1482", "description": "ATT&CK Tactic | Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1482"}]}, {"type": "attack-pattern", "id": "attack-pattern--e3a12395-188d-4051-9a16-ea8e14d07b88", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Network Service Discovery - T1046", "description": "ATT&CK Tactic | Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)   \n\nWithin cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.\n\nWithin macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host\u2019s registered services on the network. For example, adversaries can use a mDNS query (such as <code>dns-sd -B _ssh._tcp .</code>) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\""], "external_references": [{"source_name": "capec", "external_id": "CAPEC-300"}]}, {"type": "attack-pattern", "id": "attack-pattern--5372c5fe-f424-4def-bcd5-d3a8e770f07b", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Disable or Modify System Firewall - T1562.004", "description": "ATT&CK Tactic | Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.\n\nModifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. ", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Disable or Modify System Firewall - T1562.004\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1562.004"}]}, {"type": "attack-pattern", "id": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "System Binary Proxy Execution - T1218", "description": "ATT&CK Tactic | Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.\n\nSimilarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1218"}]}, {"type": "attack-pattern", "id": "attack-pattern--4061e78c-1284-44b4-9116-73e4ac3912f7", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Remote Access Tools - T1219", "description": "ATT&CK Tactic | An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be whitelisted within a target environment. Remote access tools like VNC, Ammy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)\n\nRemote access tools may be established and used post-compromise as alternate communications channel for [Redundant Access](https://attack.mitre.org/techniques/T1108) or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.\n\nAdmin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns. (Citation: CrowdStrike 2015 Global Threat Report) (Citation: CrySyS Blog TeamSpy)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1219"}]}, {"type": "attack-pattern", "id": "attack-pattern--eb062747-2193-45de-8fa2-e62549c37ddf", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Remote Desktop Protocol - T1021.001", "description": "ATT&CK Tactic | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.\n\nRemote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services) \n\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the [Accessibility Features](https://attack.mitre.org/techniques/T1546/008) or [Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) for Persistence.(Citation: Alperovitch Malware)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\""], "external_references": [{"source_name": "capec", "external_id": "CAPEC-555"}]}, {"type": "attack-pattern", "id": "attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Service Execution - T1569.002", "description": "ATT&CK Tactic | Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution.\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1569.002"}]}, {"type": "attack-pattern", "id": "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Disable or Modify Tools - T1562.001", "description": "ATT&CK Tactic | Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take the many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.\n\nAdversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\""], "external_references": [{"source_name": "capec", "external_id": "CAPEC-578"}]}, {"type": "attack-pattern", "id": "attack-pattern--b80d107d-fa0d-4b60-9684-b0433e8bdba0", "created": "2025-12-04T10:06:34.000Z", "modified": "2025-12-04T10:06:34.000Z", "name": "Data Encrypted for Impact - T1486", "description": "ATT&CK Tactic | Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)\n\nIn the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529), in order to unlock and/or gain access to manipulate these files.(Citation: CarbonBlack Conti July 2020) In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017) \n\nTo maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017) Encryption malware may also leverage [Internal Defacement](https://attack.mitre.org/techniques/T1491/001), such as changing victim wallpapers, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as \"print bombing\").(Citation: NHS Digital Egregor Nov 2020)\n\nIn cloud environments, storage objects within compromised accounts may also be encrypted.(Citation: Rhino S3 Ransomware Part 1)", "kill_chain_phases": [{"kill_chain_name": "misp-category", "phase_name": "mitre-attack-pattern"}], "labels": ["misp:galaxy-name=\"Attack Pattern\"", "misp:galaxy-type=\"mitre-attack-pattern\"", "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\""], "external_references": [{"source_name": "mitre-attack", "external_id": "T1486"}]}]}