Netwalker
NetWalker ransomware group operates by the threat actor known as "CIRCUS SPIDER". The NetWalker ransomware was discovered in 2019. The group mainly targeting the Asia Pacific region but can attack globally. The group uses common attacking tools like Mimikatz and other legitimate tools (LOLBINS) like PSTools, AnyDesk, TeamViewer, NLBrute, and more. The group knowing by targeting the healthcare sector. Finally, in January 2021, Netwalker was takedown by the authorities, the police have confiscated hundreds of thousands of dollars in ransom payments collected by the Netwalker group, and they seized servers and disrupted the infrastructure and the darknet websites of the Netwalker ransomware group.
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
- ProcDump
DiscoveryEnum
- AdFind
LOLBAS
- PsExec
Offsec
- Cobalt Strike
Known infrastructure
The following Tor hidden services have been associated with this group:
rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Netwalker’s victim list.
risk score · threat categories · sources · age · confidence — in one request