CVE
CVE-2020-1472
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is ad
Exploitation IoCs 2
Domain rhysida-leak[.]onion
GitHub Repo AdaptixC2
MITRE ATT&CK TTPs 15
T1018 T1021.001 T1059.001 T1071.001 T1075 T1078 T1082 T1089 T1090 T1098 T1133 T1484.001 T1485 T1550 T1566
Remote System Discovery
Discovery
Remote Desktop Protocol
Lateral Movement
PowerShell
Execution
Web Protocols
Command And Control
T1075
Valid Accounts
Defense Evasion
System Information Discovery
Discovery
T1089
Proxy
Command And Control
Account Manipulation
Persistence
External Remote Services
Persistence
Group Policy Modification
Defense Evasion
Data Destruction
Impact
Use Alternate Authentication Material
Defense Evasion
Phishing
Initial Access
Source Articles
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
In the first half of 2026, ransomware incidents in Japan increased slightly by 4.7%, with The Gentlemen emerging as the most active group, responsible for 14 incidents. The group operates via a Ransomware-as-a-Service (RaaS) model and uses a double-extortion tactic, leveraging infrastructure including AdaptixC2 for command-and-control. Evidence from Russian-language artifacts in scripts and bash history suggests Russian-speaking actors are involved. Qilin, the second most active group, showed signs of using generative AI in developing attack scripts, with code exhibiting structured, LLM-like patterns in tools for deploying ransomware and wiping backups.
talos Sep 17, 2026
Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
The state government of Berlin confirmed a ransomware attack and data exfiltration from its administrative network between August 7 and August 12, 2026, attributed to the Rhysida ransomware group. The attackers claimed to have stolen 5.79 terabytes of data, including personal information on over 12,000 individuals, and published a post on their darknet leak site on August 28. Despite the extortion attempt, Berlin has refused to pay the ransom. Forensic investigations are ongoing, and affected departments were isolated before being reconnected on August 23.
hacker-news Aug 28, 2026