stormous

Tactics and techniques attributed to STORMOUS by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

• TA0001Initial Access
  • T1078Valid Accounts
  • T1190Exploit Public-Facing Application
  • T1199Trusted Relationship
  • T1566Phishing
  • T1566.001Phishing: Spearphishing Attachment
• TA0002Execution
  • T1059Command and Scripting Interpreter
  • T1059.005Command and Scripting Interpreter: Visual Basic
  • T1204.002User Execution: Malicious File
• TA0003Persistence
  • T1053Scheduled Task/Job
  • T1098Account Manipulation
  • T1505.003Server Software Component: Web Shell
  • T1543.003Create or Modify System Process: Windows Service
  • T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
• TA0004Privilege Escalation
  • T1548.002Abuse Elevation Control Mechanism: Bypass UAC
• TA0005Defense Evasion
  • T1027Obfuscated Files or Information
  • T1027.002Obfuscated Files or Information: Software Packing
  • T1027.011Obfuscated Files or Information: Fileless Storage
  • T1027.013Obfuscated Files or Information: Encrypted/Encoded File
  • T1070Indicator Removal
  • T1562.001Impair Defenses: Disable or Modify Tools
• TA0006Credential Access
  • T1003OS Credential Dumping
• TA0007Discovery
  • T1046Network Service Discovery
  • T1083File and Directory Discovery
• TA0008Lateral Movement
  • T1021.001Remote Services: Remote Desktop Protocol
  • T1021.002Remote Services: SMB/Windows Admin Shares
• TA0009Collection
  • T1005Data from Local System
  • T1560Archive Collected Data
• TA0010Exfiltration
  • T1041Exfiltration Over C2 Channel
  • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
• TA0011Command and Control
  • T1071.001Application Layer Protocol: Web Protocols
• TA0040Impact
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery
• TA0042Resource Development
  • T1588.002Obtain Capabilities: Tool
• TA0043Reconnaissance
  • T1595Active Scanning