GlobeImposter Ransomware With MedusaLocker Spreading Via RDP
A GlobeImposter ransomware campaign was discovered being carried out by the attackers behind MedusaLocker.
The threat actors are suspected to have brute-forced systems with RDP enabled to gain initial access.
Various tools were used to dump passwords and perform reconnaissance including Mimikatz Advanced Port Scanner and the NirSoft Network Password Recovery tool.
In addition to encrypting files the threat actor installed XMRig to mine for digital assets.
Featured Resources
View More Resources
Project Glasswing: What Anthropic's AI Cyber Evaluations Mean for Security Validation
Project Glasswing shows frontier AI can find and exploit software flaws at scale, making continuous validation vital.
MITRE ATLAS AI Security Framework: Tactics and Techniques Explained
AI models, copilots and agents are now part of the enterprise attack surface. By connecting them to corporate data, repositories,
Operationalizing Agentic Cyber Defense Engineering for SecOps
Security operations teams spend too much of each day gathering context, configuring assessments, correlating evidence and coordinating follow-up actions across