Mandiant_UNC2165

Indrik Spider has used a service account to extract copies of the `Security` Registry hive.

Indrik Spider has used RDP for lateral movement.

Indrik Spider has used SSH for lateral movement.

Indrik Spider has used batch scripts on victim's machines.

Indrik Spider has used valid accounts for initial access and lateral movement. Indrik Spider has also maintained access to the victim environment through the VPN infrastructure.

Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.

Indrik Spider has modified registry keys to prepare for ransomware execution and to disable common administrative utilities.

Indrik Spider has created local system accounts and has added the accounts to privileged groups.

Indrik Spider has used Group Policy Objects to deploy batch scripts.

Indrik Spider has encrypted domain-controlled systems using BitPaymer. Additionally, Indrik Spider used PsExec to execute a ransomware script.

Indrik Spider has searched files to obtain and exfiltrate credentials.

Indrik Spider has accessed and exported passwords from password managers.

Indrik Spider has conducted Kerberoasting attacks using a module from GitHub.

Indrik Spider has exfiltrated data using Rclone or MEGASync prior to deploying ransomware.

Indrik Spider has purchased access to victim VPNs to facilitate access to victim environments.

Indrik Spider has downloaded tools, such as the Advanced Port Scanner utility and Lansweeper, to conduct internal reconnaissance of the victim network. Indrik Spider has also accessed the victim’s VMware VCenter, which had information about host configuration, clusters, etc.

Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring. Indrik Spider has used `MpCmdRun` to revert the definitions in Microsoft Defender. Additionally, Indrik Spider has used WMI to stop or uninstall and reset anti-virus products and other defensive services.

Indrik Spider has used Cobalt Strike to empty log files. Additionally, Indrik Spider has cleared all event logs using `wevutil`.