Description Summary
Conti-derived; shares a framework with LukaLocker and Cactus.
Threat Actor
Access via Google/Bing malvertising (fake AnyDesk/Cisco AnyConnect/WinSCP); abuses an antirootkit driver to disable AV/EDR.
Technical Indicators
Encryption Extension
.NBA
Encryption Algorithm
Conti-derived; shared framework with LukaLocker & Cactus
Ransom Note Name
readme.txt
Targeted Industries
Financial services (cross-sector)
First Seen
2024
Last Seen
Active
Geographical Location
Global
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |