Trusted Design

ZEDSEC - JAFF Ransomware IOC

概要

A massive malicious email campaign that stems from the Necurs botnet is spreading a new ransomware at the rate of 5 million emails per hour and hitting computers across the globe. Dubbed Jaff, the new file-encrypting ransomware is very similar to the infamous Locky ransomware in many ways, but it is demanding 1.79 Bitcoins (approx $3,150), which much higher than Locky, to unlock the encrypted files on an infected computer. According to security researchers at Forcepoint Security Lab, Jaff ransomware, written in C programming language, is being distributed with the help of Necurs botnet that currently controls over 6 million infected computers worldwide. Necurs botnet is sending emails to millions of users with an attached PDF document, which if clicked, opens up an embedded Word document with a malicious macro script to downloads and execute the Jaff ransomware.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

Jaff Ransomware and Suspicious PDF Delivery (score: 0.80)
Necurs Botnet Fuels Massive Spam Campaigns Spreading Jaff Ransomware (score: 0.80)
Jaff Ransomware Gets Makeover - SANS Internet Storm Center (score: 0.78)
Player 1 Limps Back Into the Ring - Hello again, Locky! (score: 0.72)
Locky: New Ransomware Mimics Dridex-Style Distribution (score: 0.66)

このPulseに関連する脅威アクター (事実ベース)

Scattered Spider

Score: 9.00

Matched TTPs:

T1564.008 - Email Hiding Rules
T1657 - Financial Theft
T1486 - Data Encrypted for Impact

MITREへのリンク →

FIN4

Score: 4.13

Matched TTPs:

T1564.008 - Email Hiding Rules

MITREへのリンク →

FIN6

Score: 8.07

Matched TTPs:

T1560.003 - Archive via Custom Method
T1569.002 - Service Execution
T1566.003 - Spearphishing via Service

MITREへのリンク →

CopyKittens

Score: 3.15

Matched TTPs:

T1560.003 - Archive via Custom Method

MITREへのリンク →

Mustang Panda

Score: 10.08

Matched TTPs:

T1560.003 - Archive via Custom Method
T1608.001 - Upload Malware
T1027 - Obfuscated Files or Information
T1564.001 - Hidden Files and Directories

MITREへのリンク →

Kimsuky

Score: 12.33

Matched TTPs:

T1560.003 - Archive via Custom Method
T1608.001 - Upload Malware
T1657 - Financial Theft
T1027 - Obfuscated Files or Information
T1102.002 - Bidirectional Communication

MITREへのリンク →

UNC3886

Score: 7.28

Matched TTPs:

T1560.003 - Archive via Custom Method
T1205.001 - Port Knocking

MITREへのリンク →

Lotus Blossom

Score: 3.15

Matched TTPs:

T1560.003 - Archive via Custom Method

MITREへのリンク →

Lazarus Group

Score: 10.74

Matched TTPs:

T1560.003 - Archive via Custom Method
T1102.002 - Bidirectional Communication
T1564.001 - Hidden Files and Directories
T1566.003 - Spearphishing via Service

MITREへのリンク →

Sandworm Team

Score: 12.62

Matched TTPs:

T1608.001 - Upload Malware
T1584.005 - Botnet
T1027 - Obfuscated Files or Information
T1486 - Data Encrypted for Impact
T1102.002 - Bidirectional Communication

MITREへのリンク →

TA2541

Score: 5.12

Matched TTPs:

T1608.001 - Upload Malware
T1027.015 - Compression

MITREへのリンク →

Earth Lusca

Score: 4.26

Matched TTPs:

T1608.001 - Upload Malware
T1027 - Obfuscated Files or Information

MITREへのリンク →

LuminousMoth

Score: 4.64

Matched TTPs:

T1608.001 - Upload Malware
T1564.001 - Hidden Files and Directories

MITREへのリンク →

Mustard Tempest

Score: 6.51

Matched TTPs:

T1608.001 - Upload Malware
T1608.006 - SEO Poisoning

MITREへのリンク →

OilRig

Score: 4.50

Matched TTPs:

T1608.001 - Upload Malware
T1566.003 - Spearphishing via Service

MITREへのリンク →

Gamaredon Group

Score: 12.96

Matched TTPs:

T1608.001 - Upload Malware
T1027 - Obfuscated Files or Information
T1102.002 - Bidirectional Communication
T1221 - Template Injection
T1027.015 - Compression

MITREへのリンク →

Threat Group-3390

Score: 5.12

Matched TTPs:

T1608.001 - Upload Malware
T1027.015 - Compression

MITREへのリンク →

TA505

Score: 4.31

Matched TTPs:

T1608.001 - Upload Malware
T1486 - Data Encrypted for Impact

MITREへのリンク →

BlackByte

Score: 10.33

Matched TTPs:

T1608.001 - Upload Malware
T1486 - Data Encrypted for Impact
T1614.001 - System Language Discovery
T1569.002 - Service Execution

MITREへのリンク →

APT32

Score: 7.04

Matched TTPs:

T1608.001 - Upload Malware
T1564.001 - Hidden Files and Directories
T1569.002 - Service Execution

MITREへのリンク →

HEXANE

Score: 4.37

Matched TTPs:

T1608.001 - Upload Malware
T1102.002 - Bidirectional Communication

MITREへのリンク →

Moonstone Sleet

Score: 11.52

Matched TTPs:

T1608.001 - Upload Malware
T1027 - Obfuscated Files or Information
T1486 - Data Encrypted for Impact
T1569.002 - Service Execution
T1566.003 - Spearphishing via Service

MITREへのリンク →

Contagious Interview

Score: 7.02

Matched TTPs:

T1608.001 - Upload Malware
T1657 - Financial Theft
T1566.003 - Spearphishing via Service

MITREへのリンク →

FIN7

Score: 11.78

Matched TTPs:

T1608.001 - Upload Malware
T1486 - Data Encrypted for Impact
T1102.002 - Bidirectional Communication
T1564.001 - Hidden Files and Directories
T1569.002 - Service Execution

MITREへのリンク →

EXOTIC LILY

Score: 4.50

Matched TTPs:

T1608.001 - Upload Malware
T1566.003 - Spearphishing via Service

MITREへのリンク →

HAFNIUM

Score: 10.42

Matched TTPs:

T1584.005 - Botnet
T1564.001 - Hidden Files and Directories
T1550.001 - Application Access Token

MITREへのリンク →

Axiom

Score: 3.62

Matched TTPs:

T1584.005 - Botnet

MITREへのリンク →

Volt Typhoon

Score: 3.62

Matched TTPs:

T1584.005 - Botnet

MITREへのリンク →

INC Ransom

Score: 7.26

Matched TTPs:

T1657 - Financial Theft
T1486 - Data Encrypted for Impact
T1569.002 - Service Execution

MITREへのリンク →

Malteiro

Score: 6.14

Matched TTPs:

T1657 - Financial Theft
T1614.001 - System Language Discovery

MITREへのリンク →

FIN13

Score: 5.19

Matched TTPs:

T1657 - Financial Theft
T1564.001 - Hidden Files and Directories

MITREへのリンク →

Storm-0501

Score: 8.49

Matched TTPs:

T1657 - Financial Theft
T1486 - Data Encrypted for Impact
T1614.001 - System Language Discovery

MITREへのリンク →

Akira

Score: 4.86

Matched TTPs:

T1657 - Financial Theft
T1486 - Data Encrypted for Impact

MITREへのリンク →

Medusa Group

Score: 11.80

Matched TTPs:

T1657 - Financial Theft
T1486 - Data Encrypted for Impact
T1569.002 - Service Execution
T1218.014 - MMC

MITREへのリンク →

Water Galura

Score: 4.86

Matched TTPs:

T1657 - Financial Theft
T1486 - Data Encrypted for Impact

MITREへのリンク →

PROMETHIUM

Score: 4.13

Matched TTPs:

T1205.001 - Port Knocking

MITREへのリンク →

APT28

Score: 20.33

Matched TTPs:

T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1102.002 - Bidirectional Communication
T1221 - Template Injection
T1564.001 - Hidden Files and Directories
T1550.001 - Application Access Token
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

CURIUM

Score: 6.37

Matched TTPs:

T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1566.003 - Spearphishing via Service

MITREへのリンク →

Storm-1811

Score: 8.71

Matched TTPs:

T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1486 - Data Encrypted for Impact
T1566.003 - Spearphishing via Service

MITREへのリンク →

RedCurl

Score: 4.95

Matched TTPs:

T1027 - Obfuscated Files or Information
T1564.001 - Hidden Files and Directories

MITREへのリンク →

Rocke

Score: 4.95

Matched TTPs:

T1027 - Obfuscated Files or Information
T1564.001 - Hidden Files and Directories

MITREへのリンク →

Windshift

Score: 4.81

Matched TTPs:

T1027 - Obfuscated Files or Information
T1566.003 - Spearphishing via Service

MITREへのリンク →

Ke3chang

Score: 8.31

Matched TTPs:

T1027 - Obfuscated Files or Information
T1614.001 - System Language Discovery
T1569.002 - Service Execution

MITREへのリンク →

APT37

Score: 4.68

Matched TTPs:

T1027 - Obfuscated Files or Information
T1102.002 - Bidirectional Communication

MITREへのリンク →

APT41

Score: 7.03

Matched TTPs:

T1027 - Obfuscated Files or Information
T1486 - Data Encrypted for Impact
T1569.002 - Service Execution

MITREへのリンク →

APT38

Score: 4.74

Matched TTPs:

T1486 - Data Encrypted for Impact
T1569.002 - Service Execution

MITREへのリンク →

Magic Hound

Score: 7.26

Matched TTPs:

T1486 - Data Encrypted for Impact
T1102.002 - Bidirectional Communication
T1566.003 - Spearphishing via Service

MITREへのリンク →

APT39

Score: 4.80

Matched TTPs:

T1102.002 - Bidirectional Communication
T1569.002 - Service Execution

MITREへのリンク →

APT29

Score: 7.06

Matched TTPs:

T1651 - Cloud Administration Command
T1566.003 - Spearphishing via Service

MITREへのリンク →

Dragonfly

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

Confucius

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

Tropic Trooper

Score: 5.82

Matched TTPs:

T1221 - Template Injection
T1564.001 - Hidden Files and Directories

MITREへのリンク →

Inception

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

DarkHydrus

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

Equation

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Strider

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Velvet Ant

Score: 6.53

Matched TTPs:

T1569.002 - Service Execution
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

Molerats

Score: 3.15

Matched TTPs:

T1027.015 - Compression

MITREへのリンク →

Higaisa

Score: 3.15

Matched TTPs:

T1027.015 - Compression

MITREへのリンク →

Mofang

Score: 3.15

Matched TTPs:

T1027.015 - Compression

MITREへのリンク →

Leviathan

Score: 3.15

Matched TTPs:

T1027.015 - Compression

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

APT28

Score: 0.80

Matched TTPs:

T1221 - Template Injection
T1102.002 - Bidirectional Communication
T1211 - Exploitation for Defense Evasion
T1550.001 - Application Access Token
T1564.001 - Hidden Files and Directories
T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

MITREへのリンク →

FIN7

Score: 0.56

Matched TTPs:

T1102.002 - Bidirectional Communication
T1608.001 - Upload Malware
T1486 - Data Encrypted for Impact
T1569.002 - Service Execution
T1564.001 - Hidden Files and Directories

MITREへのリンク →

Sandworm Team

Score: 0.55

Matched TTPs:

T1584.005 - Botnet
T1102.002 - Bidirectional Communication
T1608.001 - Upload Malware
T1027 - Obfuscated Files or Information
T1486 - Data Encrypted for Impact

MITREへのリンク →

Medusa Group

Score: 0.55

Matched TTPs:

T1657 - Financial Theft
T1569.002 - Service Execution
T1218.014 - MMC
T1486 - Data Encrypted for Impact

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る