PROTON EMAIL AFFILIATE INSTALL

“Once the ransomware is successfully deployed, the victim will start to receive phone calls through spoofed phone numbers with ransom demands and are provided a ProtonMail email address for further communication,” the Bureau says. The FBI says the gang exfiltrates the victim’s data before encrypting it, then holds the stolen data for ransom. The actors have been observed within the victim’s network for approximately one month prior to deployment of the ransomware.” The actors use rclone for data exfiltration from the victim’s network.

PROTON EMAIL AFFILIATE INSTALL

The actors use IcedID to install and execute the software Cobalt Strike on the victim’s network to move laterally to other systems within the environment through PowerShell remoting. “The zip file includes a Microsoft Word or Excel document that contains malicious macros that allow the actors to subsequently infect the victim’s system with the banking Trojan IcedID. “OnePercent Group actors gain unauthorized access to victim networks through phishing emails with a malicious zip file attachment,” the FBI says. The threat actor gains initial access via phishing emails. The Record notes that the OnePercent Group is an affiliate of the REvil, Maze, and Egregor ransomware gangs.

The US Federal Bureau of Investigation (FBI) has issued an advisory describing a ransomware affiliate that calls itself “OnePercent Group,” the Record reports.

Proton email affiliate