#StopRansomware: Daixin Team

The Daixin Team is a ransomware and data extortion group that has targeted the HPH Sector with ransomware and data extortion operations since at least June 2022. Since then, Daixin Team cybercrime actors have caused ransomware incidents at multiple HPH Sector organizations.

REFERENCE: https://www.cisa.gov/uscert/ncas/alerts/aa22-294a

TAGS: Daixin, Phishing, Ransomware, Exfiltration, Rclone, Ngrok, VPN Server

ADVERSARY: Daixin

INDUSTRIES: Critical Infrastructure, Human Services

TARGETED COUNTRY: United States of America

ATT&CK IDS: T1021 - Remote Services, T1133 - External Remote Services, T1007 - System Service Discovery, T1136 - Create Account, T1003 - OS Credential Dumping, T1471 - Data Encrypted for Impact, T1083 - File and Directory Discovery, T1566 - Phishing, T1027 - Obfuscated Files or Information, T1098 - Account Manipulation, T1563 - Remote Service Session Hijacking

Read More:

https://otx.alienvault.com/pulse/635691457ea5ecfbbfae6bf8