Threat hunts for Teamviewer
6 hunts covering Teamviewer, each with a hypothesis, the queries that test it and what the hunt cannot see.
6 hunts
-
high Part 3 of 3Research by CISA
SafePay Ransomware: Exfiltration and Impact
Adversaries have staged data using rare archival or cloud-sync tools and are now inhibiting system recovery by deleting shadow copies before executing a ransomware payload that renames user files to include the .SafePay extension.
3 query1 analytic1 checkpoint1 action2 taskCVE-2020-3259 · CVE-2023-20269 -
high Part 2 of 3Research by CISA
SafePay: Internal Discovery and Lateral Movement
An adversary is using legitimate administrative tools and scripts to enumerate network shares and move laterally via remote management protocols while disabling local security software.
3 query1 analytic1 checkpoint1 action2 taskCVE-2020-3259 · CVE-2023-20269 -
high Part 1 of 3Research by CISA
SafePay: External Access and Identity Consolidation
An adversary has exploited a known edge vulnerability to gain a foothold and is consolidating control by creating administrative accounts and escalating local privileges via UAC bypass.
4 query2 analytic2 checkpoint1 action2 taskCVE-2020-3259 · CVE-2023-20269 -
high Part 2 of 3Research by CISA
SafePay: Internal Enumeration and Lateral Movement
SafePay actors have established a foothold and are using repurposed administrative tools, credential dumpers, and anomalous RDP or SMB sessions to move laterally toward file shares.
3 query1 analytic1 checkpoint1 action2 taskCVE-2020-3259 · CVE-2023-20269 -
high Part 1 of 3Research by CISA
SafePay Ransomware: Perimeter Breach and Account Persistence
An adversary has exploited unpatched edge vulnerabilities or use VPN-based brute force to gain initial access, subsequently creating or elevating accounts to secure administrative persistence.
4 query1 analytic1 checkpoint1 action2 taskCVE-2020-3259 · CVE-2023-20269 -
criticalResearch by Cisco Talos
NetScaler exploitation and RMM-driven ransomware
An attacker has exploited vulnerabilities in a public-facing gateway or remote access tool to execute a backdoor, followed by establishing persistence via unauthorized RMM software and initiating ransomware file encryption.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · execution · impact