Pandora Ransomware

Malware updated a month ago (2024-11-29T13:39:49.347Z)
Download STIX
Preview STIX
Pandora ransomware is a type of malware that has been connected to several other malicious software strains, including AtomSilo, Night Sky, and Rook. Researchers from CTU identified code overlap between the updated HUI Loader samples and Pandora ransomware, suggesting a common origin or shared development resources. The HUI Loader, which has been known to load Cobalt Strike Beacon, has also been linked to LockFile, AtomSilo, Rook, Night Sky, and Pandora ransomware activities. This connection was established through an analysis of the Cobalt Strike Beacon samples loaded by HUI Loader. Further analysis revealed that two HUI Loader samples that may have been hosted on certain servers share code with Pandora ransomware. This finding underscores the interconnections between these different types of malware, highlighting the complexities of the cybersecurity landscape. In addition to these connections, similarities were observed across Rook, Night Sky, and Pandora ransomware, further indicating possible shared origins or tactics among these threats. The Pandora ransomware is believed to be an evolution of a previous version attributed to the Chinese cyberespionage operation Bronze Starlight. Additionally, a new strain of ransomware, CatB, features a dropper with anti-analysis checking capabilities that eventually exploits MSDTC to enable the injection of the oci.dll payload with the ransomware strain, as per a SentinelOne report. This evolution and development of new ransomware strains illustrate the continuous advancement and sophistication of cyber threats.
Description last updated: 2024-05-04T19:15:09.695Z
What's your take? (Question 1 of 0)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Ransomware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the Pandora Ransomware Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
Secureworks
2 years ago
CERT-EU
2 years ago