Associated Groups

Comment Crew
Comment Group
Comment Panda

Command and Control Web url of APT 1

Be advised that the below web url are malicious in nature

hgcurtain.com
cultivr.com
tensins.net
decipherment.net
konamidata.com
cbssrayli.com
windowsupdote.net
ctaböe.org
gamemuster.com
kyroceras.net
nestlere.com
raylitoday.com
renewgis.com
siseau.com
bmwauto.org
t008.net
vssigma.com
hfmforum.com
checalla.com
unina2.net
anyoffice.info
it-bar.net
jjdesk.com
satelliteclub.info
space-today.info
sst1.info
stream-media.net
adomhn.com
psactel.com
eldaedu.us
na,codat.com
ptkstore.com
graceland-siu.org
xafsl5.org
feilglobe.com
creativezh.com
anfoundation.us
rwchateau.com

Hashes

4c50457c35e2033b3a03fcbb4adac7b7
38a2a6782e1af29ca8cb691cf0d29a0d
08c7b5501df060ccfc3aa5c8c41b452f
fc121db04067cffbed04d7403c1d222d376fa7ba
832d5e6ebd9808279ee3e59ba4b5b0e884b859a5
be4fbb5a4b32db20a914cad5701f5c7ba51571b7
1f70715e86a2fcc1437926ecfaeadc53ddce41c9
dd3fb2750da3e8fc889cd1611117b02d49cf17f7
583879cfaf735fa446be5bfcbcc9e580bf542c8c
ec9a9d431fd69e23a5b770bf03fe0fb5a21c0c36
d72bc671583801c3c65ac1a96bb75c6026e06a73
e5c6229825f11d5a5749d3f2fe7acbe074cba77c
9fe4bfdd258ecedb676b9de4e23b86b1695c4e1e
281a13ecb674de42f2e8fdaea5e6f46a5436c685
42192bb852d696d55da25b9178536de6365f0e68
12a9faa96ba1be8a73e73be72ef1072096d964fb
0ae167204c841bdfd3600dddf2c9c185b17ac6d4

IP Address

158.69.131.78
172.81.132.62
27.102.112.179
211.104.160.196

The post APT 1 & its IOC’s appeared first on CyberHood Sentinel.

Early Sunday morning, the Lazio region suffered a ransomware attack that encrypted every file in its data center and disrupted its IT network.

“On the night between Saturday and Sunday the Regione Lazio suffered a first cyber attack of criminal matrix. We don’t know who is responsible and their goals,” Nicola Zingaretti, the President of the Lazio region, said in a statement.

“The attack blocked almost every file in the data center. The vaccination campaign continues as normal for all those who have booked. Vaccine bookings will open for now suspended in the next few days. The system is currently shut down to allow internal verification and to avoid the spread of the virus introduced with the attack.”

While ransomware gangs are known to steal data during an attack as leverage in extortion attempts, the region states that health, financial, and budget data are safe.

While ransomware gangs are known to steal data during an attack as leverage in extortion attempts, the region states that health, financial, and budget data are safe.

The outage has also affected the Salute Lazio health portal used to register for COVID-19 vaccines.

“There is a powerful hacking attack on regional ced. The systems are all disabled including all of the Salute Lazio portal and the vaccine network. All defense and verification operations are under way to avoid the misappropriation. Vaccination operations may experience delays,” the region said in a statement.

In June, Italy instituted a new ‘Green Pass’ certificate system that allows people to prove that they have been vaccinated, tested negative, or previously had COVID-19. 

This green pass will be required for indoor dining at restaurants and bars and be required to access fitness centers, amusements parks, museums, and other locations with a large crowd starting on August 6th.

With over 70% of the Lazio population vaccinated and a massive surge in registrations since the announcement of the Green Pass policy, there is concern that the disruption to the online COVID-19 vaccination 

However, the region states that there has been no disruption to existing appointments for vaccinations and that the online registration system should be back online in a few days. 

“The vaccination campaign won’t stop! In yesterday’s day, 50 thousand vaccines were administered, despite the biggest cyber attack suffered,” the region stated on Facebook.

RansomEXX ransomware is behind the attack

In a redacted ransom note shared from the attack on Lazio, the threat actors state, “Hello, Lazio!” and warn the region that their files were encrypted. The ransom note also includes a link to a private dark web page that Lazio can use to negotiate with the ransomware gang.

The ransom note does not state what operation conducted the attack but the ONION URL listed is a known Tor site for the RansomEXX operation.

RansomEXX IOC’s to be used by SOC and Threat Intel groups

Campaign IOC

You can find the complete list of detection IOC for RansomEXX here.

The post COVID 19 Sites in Italy’s Lazio region suffered a Ransomware attack appeared first on CyberHood Sentinel.