ATT&CK ReferencesMicrosoft Ransomware as a Service

Microsoft Ransomware as a Service

Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.

Open the source

Techniques1

T1650Acquire Access

Groups2

Cinnamon Tempest Mustard Tempest

Software1

Diavol

Campaigns0

None recorded.

Procedure examples20

Technique	Used by	Procedure example
T1016 System Network Configuration Discovery	MalwareQakBot	QakBot can use `net config workstation`, `arp -a`, `nslookup`, and `ipconfig /all` to gather network configuration information. Crowdstrike Qakbot October 2020 Group IB Ransomware September 2020 Kaspersky QakBot September 2021 Microsoft Ransomware as a Service Trend Micro Black Basta October 2022
T1047 Windows Management Instrumentation	GroupCinnamon Tempest	Cinnamon Tempest has used Impacket for lateral movement via WMI. Microsoft Ransomware as a Service Sygnia Emperor Dragonfly October 2022
T1059.003 Windows Command Shell	GroupCinnamon Tempest	Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO. Microsoft Ransomware as a Service
T1059.006 Python	GroupCinnamon Tempest	Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files. Microsoft Ransomware as a Service
T1078.002 Domain Accounts	GroupCinnamon Tempest	Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware. Microsoft Ransomware as a Service
T1078.003 Local Accounts	GroupFIN7	FIN7 has used compromised credentials for access as SYSTEM on Exchange servers. Microsoft Ransomware as a Service
T1080 Taint Shared Content	GroupCinnamon Tempest	Cinnamon Tempest has deployed ransomware from a batch file in a network share. Microsoft Ransomware as a Service
T1082 System Information Discovery	MalwareQakBot	QakBot can collect system information including the OS version and domain on a compromised host. ATT QakBot April 2021 Crowdstrike Qakbot October 2020 Group IB Ransomware September 2020 Microsoft Ransomware as a Service
T1082 System Information Discovery	GroupMustard Tempest	Mustard Tempest has used implants to perform system reconnaissance on targeted systems. Microsoft Ransomware as a Service
T1105 Ingress Tool Transfer	GroupMustard Tempest	Mustard Tempest has deployed secondary payloads and third stage implants to compromised hosts. Microsoft Ransomware as a Service
T1190 Exploit Public-Facing Application	GroupCinnamon Tempest	Cinnamon Tempest has exploited multiple unpatched vulnerabilities for initial access including vulnerabilities in Microsoft Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j. Microsoft Log4j Vulnerability Exploitation December 2021 Microsoft Ransomware as a Service SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 Sygnia Emperor Dragonfly October 2022
T1190 Exploit Public-Facing Application	GroupFIN7	FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange. Microsoft Ransomware as a Service
T1204.001 Malicious Link	GroupMustard Tempest	Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails. Microsoft Ransomware as a Service SocGholish-update
T1204.002 Malicious File	MalwareQakBot	QakBot has gained execution through users opening malicious attachments. ATT QakBot April 2021 Crowdstrike Qakbot October 2020 Cyberint Qakbot May 2021 Deep Instinct Black Basta August 2022 Group IB Ransomware September 2020 Kaspersky QakBot September 2021 Kroll Qakbot June 2020 Microsoft Ransomware as a Service Trend Micro Qakbot December 2020 Trend Micro Qakbot May 2020
T1484.001 Group Policy Modification	GroupCinnamon Tempest	Cinnamon Tempest has used Group Policy to deploy batch scripts for ransomware deployment. Microsoft Ransomware as a Service
T1566.001 Spearphishing Attachment	MalwareQakBot	QakBot has spread through emails with malicious attachments. ATT QakBot April 2021 Cyberint Qakbot May 2021 Deep Instinct Black Basta August 2022 Group IB Ransomware September 2020 Kaspersky QakBot September 2021 Kroll Qakbot June 2020 Microsoft Ransomware as a Service Trend Micro Qakbot December 2020 Trend Micro Qakbot May 2020
T1574.001 DLL	GroupCinnamon Tempest	Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons. Cinnamon Tempest has also abused legitimate executables to side-load weaponized DLLs. Microsoft Ransomware as a Service SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 Sygnia Emperor Dragonfly October 2022
T1583.008 Malvertising	GroupMustard Tempest	Mustard Tempest has posted false advertisements including for software packages and browser updates in order to distribute malware. Microsoft Ransomware as a Service
T1608.006 SEO Poisoning	GroupMustard Tempest	Mustard Tempest has poisoned search engine results to return fake software updates in order to distribute malware. Microsoft Ransomware as a Service SocGholish-update
T1657 Financial Theft	GroupCinnamon Tempest	Cinnamon Tempest has maintained leak sites for exfiltrated data in attempt to extort victims into paying a ransom. Microsoft Ransomware as a Service

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.