SOC News | Apr 30 – New Cyber Attacker Groups Detected
During the last week of April, our Attacker Centric SOC detected multiple new cyber attacker group websites in the Dark Web. Called Dedicated Leak Sites (DLS), they are widely used by ransomware gangs to publish stolen confidential data when the victim refuses to pay the ransom. Usually, after an attack is claimed, a small amount of data is published to show proof of the attack’s success and induce the victim to pay.
We maintain a GitHub repository with a collection of Cyber Threat Intelligence (CTI) sources coming from the Deep and Dark Web. The last additions to the ransomware gangs were as follows:
EMBARGO (21/04/2024)
QIULONG (22/04/2024)
dAn0n (25/04/2024)
SpaceBears (29/04/2024)
The following are screenshots of the DLS:
Activities of these new groups are already being monitored by our Threat Intelligence Platform SATAYO.
Mirko Ioris
Technical Consultant - Cyber Security Team | Würth IT Italy
Author
Mirko Ioris
Technical Consultant - Cyber Security Team | Würth IT Italy
As a Cyber Threat Intelligence (CTI) Analyst, my daily work often involves analyzing suspicious domains that look like our clients' brands. One of our goals is to prevent phishing campaigns and brand abuse. We usually hunt for external threats like Read More
A scalable approach to detecting malicious domains using Threat Intelligence and Indicator Match Rules One of the most common techniques used in phishing and initial access campaigns is the creation of domains that closely resemble legitimate ones. Attackers exploit typosquatting, Read More
As 2025 comes to a close, we can make some observations regarding the evolution of the double-extortion ransomware attack landscape. The data shown is the result of the enrichment performed within SATAYO starting from the data made available by the Read More
Introduction Kerberoasting remains one of the most popular techniques for attackers attempting to escalate privileges inside a Windows domain. By requesting service tickets (TGS - Ticket Granting Service) encrypted with weak algorithms, an attacker can extract hashes and crack them Read More
Producing actionable intelligence must be the mindset that every Threat Intelligence analyst must set as their primary objective. The problem of properly integrating Threat Intelligence into Security Operations processes is a recurring one. In this article, I aim to describe Read More
