| Category | Details | References |
|---|---|---|
| Actors | ||
| First Observed | May 2021. Possible new variant/group active since August 2022 | 1 |
| Threat Actors | TBD | |
| Environment | ||
| Platforms | Windows | 2 |
| Artifacts | ||
| Extensions | .venus .Ywkfistef .anigma | 2 |
| Ransomware Notes | README.txt README.html, README.hta Also can change desktop wallpaper to ransom note | 2 3 |
| Services It Disables | Disables at least 39 named services | 2 |
| Other Observables | TBD | |
| Automation | ||
| Automatically Gains Access | Not automated, typically accessed via RDP | 1 |
| Automatically Escalates Privileges | No | |
| Requires Human Interaction | No | |
| Automatic Exfiltration | No | |
| Automatic Propagation | No |
Please note, this page was last updated at 2023-03-14 20:21.