Precursor Intelligence

Threat News

Latest cyber threat intelligence, breaches and exploitation

1 matching story

ProxyShell
  • Ransomware Incident22d ago·8 sources

    LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay

    LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.

    ransomwarePetitPotamNTLM relay+3
    LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay