Post

Our SOC tackled an attempted ransomware intrusion tied to Makop ransomware tactics. Here’s what went down 👇 🎯 Initial Entry Point: Brute-forced an exposed RDP service (don’t skip reviewing your external perimeters!). 🗺️ Enumeration & Credential Targeting: Ran a network scan using netscan.exe.

🔑 Followed up with brute-force credential attacks tied to known Makop tooling. 🚀 Lateral Movement & Persistence: Deployed a renamed Mesh Agent via PsExec. 🔍 Attempted to disguise their remote access tool as a benign binary (wvspbind.exe).

🔥 RDP Enabled for Further Access: Modified the firewall to reopen RDP using CLI commands. If you see renamed remote access binaries or odd PsExec usage, you may be facing more than a nuisance script kiddie.