sinobi

T1078Valid Accounts

Use of valid credentials from MSPs (Managed Service Providers).

T1190Exploit Public-Facing Application

Exploitation of vulnerabilities in VPNs (SonicWall).

T1566Phishing

T1059.001Command and Scripting Interpreter: PowerShell

Heavy use of PowerShell for script and in-memory command execution.

T1059.003Command and Scripting Interpreter: Windows Command Shell

T1106Native API

T1203Exploitation for Client Execution

T1569.002System Services: Service Execution

T1543.003Create or Modify System Process: Windows Service

Creation or modification of Windows services to ensure malware restart.

T1068Exploitation for Privilege Escalation

T1027Obfuscated Files or Information

T1070Indicator Removal

Removal of event logs.

T1070.004Indicator Removal: File Deletion

T1562.001Impair Defenses: Disable or Modify Tools

Active disabling of EDR solutions (such as VMware Carbon Black).

T1046Network Service Discovery

T1083File and Directory Discovery

T1087.002Account Discovery: Domain Account

T1021.001Remote Services: Remote Desktop Protocol

Use of RDP to navigate between servers after privilege escalation.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Use of Rclone tool to send data to public cloud providers before encryption.

T1573.001Encrypted Channel: Symmetric Cryptography

T1486Data Encrypted for Impact

Data encryption via AES-128-CTR and Curve-25519, adding the .SINOBI extension.

T1489Service Stop

T1490Inhibit System Recovery

Deletion of Shadow Copies via vssadmin.exe.

T1587.001Develop Capabilities: Malware

T1588.002Obtain Capabilities: Tool