Post

Huntress
@huntress.com

Our SOC tackled an attempted ransomware intrusion tied to Makop ransomware tactics. Here’s what went down 👇 🎯 Initial Entry Point: Brute-forced an exposed RDP service (don’t skip reviewing your external perimeters!). 🗺️ Enumeration & Credential Targeting: Ran a network scan using netscan.exe.

Huntress
@huntress.com

🔑 Followed up with brute-force credential attacks tied to known Makop tooling. 🚀 Lateral Movement & Persistence: Deployed a renamed Mesh Agent via PsExec. 🔍 Attempted to disguise their remote access tool as a benign binary (wvspbind.exe).

0 reposts0 likes

Huntress
@huntress.com

🔥 RDP Enabled for Further Access: Modified the firewall to reopen RDP using CLI commands. If you see renamed remote access binaries or odd PsExec usage, you may be facing more than a nuisance script kiddie.

Huntress
@huntress.com

These behaviours echo Makop ransomware, and they're often paired with attempts to gain long-term footholds via remote access tools. We have observed these tactics in previous incidents and were able to catch and neutralize the threat to this IT org before it could wreak havoc.