Timofey Ezhov

Nov 26, 2024 | securelist.com | Cristian Souza |Eduardo Ovalle |Ashley Munoz |Timofey Ezhov

IntroductionIn a recent incident response case, we dealt with a variant of the Mimic ransomware with some interesting customization features. The attackers were able to connect via RDP to the victim’s server after a successful brute force attack and then launch the ransomware. After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).