Malware

SHATTEREDGLASS

Also known as: Unidentified 081

Kaspersky Labs observed Andariel to drop this ransomware in one case within a series of attacks carried out against targets in South Korea in April 2021.

Indicators of Compromise 3

Filename main.exe GitHub Repo impacket/impacket GitHub User impacket

MITRE ATT&CK TTPs 22

OS Credential Dumping

Credential Access

Remote System Discovery

Remote Desktop Protocol

Lateral Movement

SMB/Windows Admin Shares

Lateral Movement

Network Sniffing

Credential Access

Command and Scripting Interpreter

Clear Windows Event Logs

Defense Evasion

Command And Control

System Information Discovery

Account Discovery

Command And Control

Account Manipulation

Ingress Tool Transfer

Command And Control

External Remote Services

Exploitation for Client Execution

Data Destruction

Firmware Corruption

Internal Spearphishing

Lateral Movement

Spearphishing Link

Source Articles

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

Gunra ransomware, a Conti-derived operation, has been actively targeting critical infrastructure sectors globally, including healthcare, financial services, and government facilities. The group exploits known vulnerabilities in Fortinet (CVE-2025-24472) and Schneider Electric (CVE-2024-5559) devices to gain initial access, then uses Impacket tools for lateral movement and credential dumping. Gunra employs a double extortion model, exfiltrating data before encryption, and has listed 51 victims on its leak site since April 2025, primarily in South Korea, Brazil, and Europe. The group has ties to affiliate programs, uses WhatsApp for negotiations, and has demonstrated advanced capabilities such as MFA bypass and session hijacking via SSL-VPN manipulation.

hacker-news ·8h ago