spook

Executive Summary

The threat actor known as 'spook' operates as a rebranded version of the Prometheus ransomware group, focusing on double-extortion attacks. Active between October 4-19, 2021, they targeted primarily the manufacturing sector globally and uniquely published victim names regardless of payment.

Goals & Targeting

Spook's strategic goals are primarily financial gain through ransomware operations. Their focus on double extortion and data leak threats aligns with maximizing monetary gains. The concentration on manufacturing suggests targets with significant data or operational disruption potential.

Spook is a criminal threat actor operating under the guise of Prometheus, using the Thanos builder for ransomware operations. Their activities are centered around double-extortion tactics, encrypting data and threatening data leaks unless ransoms are paid. Known for concentrating their attacks on manufacturing sectors globally, spook emerged briefly in late 2021 with notable TTPs including spear-phishing campaigns and targeting vulnerabilities like RDP access.

Key Capabilities

• Ransomware deployment
• Double extortion tactics (data encryption and leak)
• Spear-phishing campaigns using macro-laced documents
• Exploitation of RDP vulnerabilities
• Brute force attack techniques

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Spook's campaigns were active around two weeks in late 2021, targeting mainly the manufacturing sector with 35 recorded victims. Notable for publishing victim names post-attack, regardless of ransom payment.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• RDP brute-force attempts and unauthorized access
• Encrypted files across network shares and endpoints

Recommended Actions

• Strengthen RDP security protocols and consider disabling if unused.
• Enhance phishing awareness training for employees.
• Deploy network monitoring tools to detect C2 communications.
• Implement robust backup strategies to mitigate ransomware impact.

Suggested Tags