s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-MAL-elf.abyss

📛 Threat Title

Malware family: Abyss Locker

Category: Abyss Locker First seen: Last updated: Source: ThreatFox Malwares

Description

ThreatFox malware family `elf.abyss`. Printable name: Abyss Locker. Aliases: elf.hellokitty.

Indicators of Compromise (2)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain elf.hellokitty VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.hellokitty

IOC database

Type
domain
Value
elf.hellokitty
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Extracted from Threat TF-MAL-elf.hellokitty

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.hellokitty

domain elf.abyss VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.abyss

IOC database

Type
domain
Value
elf.abyss
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat TF-MAL-elf.abyss

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.abyss

References (1)

Remediations (10)

  • Abyss Locker Ransomware Targeting Windows and Linux Platforms
    web:advisory.eventussecurity.com

    The Abyss Locker ransomware poses a high-severity threat to organizations and individuals, exploiting vulnerabilities in both Windows and Linux environments. Its ability to steal and encrypt sensitive data underscores the urgency of robust cybersecurity measures.

  • PDF Abyss Ransomware - blackpointcyber.com
    web:blackpointcyber.com

    Abyss (AKA Abyss Locker ) ransomware operation has been active since, at least, March 2023 and participates in the double extortion method, where victims' data is stolen and leaked if the ransom demand is not paid.

  • Abyss Locker Ransomware Targeting Critical Network Devices, Including ...
    web:cyberpress.org

    The Abyss Locker ransomware group has emerged as a significant cyber threat, targeting critical network devices such as VMware ESXi servers, NAS devices, and VPN appliances. This ransomware operation, active since 2023, employs advanced tactics to infiltrate networks, exfiltrate sensitive data, and encrypt systems for financial extortion.

  • PDF Threat Advisory - hivepro.com
    web:hivepro.com

    These solutions can detect and block malicious activities associated with Abyss Locker ransomware, such as file encryption and unauthorized processes. Regularly update endpoint security software to ensure protection against the latest threats.

  • The Growing Threat of Abyss Locker Ransomware: Tactics, Impact, and ...
    web:undercodenews.com

    The use of sophisticated techniques such as credential harvesting, anti-virus tool disabling, and SSH tunneling highlights Abyss Locker's commitment to maintaining persistence and avoiding detection. These tactics ensure that attackers can move laterally within the network, accessing more devices and potentially increasing the ransom payout.

  • Abyss Locker Ransomware Hits Windows, ESXi, and NAS Devices
    web:www.anvilogic.com

    Sygnia reveals Abyss Locker ransomware tactics, exploiting SonicWall VPN vulnerabilities to infiltrate networks, steal credentials, and encrypt critical systems. Learn about their methods and mitigation steps.

  • Ransomware Roundup - Abyss Locker | FortiGuard Labs
    web:www.fortinet.com

    The Abyss Locker threat actor steals victims' data before deploying and running its ransomware malware for file encryption. The ransomware is also capable of deleting Volume Shadow Copies and system backups. Infection Vector Information on the infection vector used by the Abyss Locker ransomware threat actor is unavailable.

  • Abyss Locker Ransomware: Analysis, Detection, and Mitigation
    web:www.sentinelone.com

    Abyss Locker Ransomware has left many victims in the dark. Uncover its infection path, ransom demands, and how to prevent future attacks.

  • Abyss Locker Ransomware: Attack Flow & Defense Strategies | Sygnia
    web:www.sygnia.co

    Discover Abyss Locker ransomware's attack flow, tactics, and techniques. Learn how to defend against this evolving cyber threat with expert insights from Sygnia.

  • Abyss Locker Ransomware - Updated Profile - TIR
    web:www.threatintelreport.com

    1. Executive Summary Abyss Locker (also referred to as " Abyss ") is a double-extortion ransomware operation active since at least 2023, with a recurring focus on virtualisation infrastructure (notably VMware ESXi), edge devices, and backup systems. According to Sygnia's incident analysis, intrusions commonly start from compromised perimeter appliances (including SonicWall SMA), followed ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.