Ransomware that targets network attached storage.
+Ransomware that targets virtualized environment such as Vmware or Hyper-V.
+Ransomware that targets mobile devices.
@@ -74776,6 +74789,107 @@ unified-kill-chain namespace available in JSON format at +| + + | ++unified-ransomware-kill-chain namespace available in JSON format at this location. The JSON format can be freely reused in your application or automatically enabled in MISP taxonomy. + | +
The Unified Ransomware Kill Chain, a intelligence driven model developed by Oleg Skulkin, aims to track every single phase of a ransomware attack.
+Ransomware affiliates may gain the access to the target network or purchase such access from the initial access brokers.
+Ransomware affiliates may need to collect information about the compromised perimeter, elevate its privileges and access credentials, as well as disabling or bypassing defenses to initiate the discovery and propagation.
+Ransomware affiliates, before starting network propagation, need to collect information about remote systems.
+Ransomware affiliates start to acquire additional data, such as privileged credentials, sensitive information and backup related to critical assets.
+Ransomware affiliates use legitimate tools and techniques to move laterally through the network.
+Ransomware affiliates may collect data from one or multiple sources, such as network attached storages, cloud storages and so on, and proceed with the exfiltration.
+Ransomware affiliates disable and remove security solutions or available backups prior to ransomware deployment.
+Ransomware affiliates attempt to achieve their main goal: deploy the ransomware.
+Ransomware affiliates, after encrypting the victim’s assets, may start to upload sample of exfiltrated data on the DLS, call the victims' employees, and even perform DDOS attacks against the compromised infrastructure only to facilitate extortion.
+