Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Understanding REvil: The Ransomware Gang Behind the Kaseya Attack. Parent comment
They deployed the payload via a trusted channel (Kaseya) which allowed deployment of any executable via system privs.
They looked for certain AV products and only executed if it was on their list.
They didn't delete shadow copies. (to avoid behavioral detection)
They didn't try to exfiltrate data. (to avoid behavioral detection)
They did a combo of automation and typical hollywood hacker on keyboard command and control.
No dwell time.
There are no comments on this comment yet.
They deployed the payload via a trusted channel (Kaseya) which allowed deployment of any executable via system privs.
They looked for certain AV products and only executed if it was on their list.
They didn't delete shadow copies. (to avoid behavioral detection)
They didn't try to exfiltrate data. (to avoid behavioral detection)
They did a combo of automation and typical hollywood hacker on keyboard command and control.
No dwell time.