APT / THREAT GROUP

Atomsilo

aliases

Intelligence Profile

AtomSilo is a new Ransomware recently seen in September 2021 during one of their attacks by exploiting a recently revealed vulnerability (CVE-2021-26084) in Atlassian’s Confluence Collaboration Software for initial access. The Ransomware used the double extortion method which is gaining popularity among ransomware threat actors where they first, exfiltrate the confidential information and as a second step encrypt the system files.

Threat Analysis

Atomsilo is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.cyfirma.com/outofband/malware-research-on-atomsilo-ransomware/

→https://www.zscaler.com/blogs/security-research/atomsilo-ransomware-enters-league-double-extortion

→https://twitter.com/siri_urz/status/1437664046556274694

→https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/

→https://chuongdong.com/reverse%20engineering/2021/10/13/AtomSiloRansomware/

→https://decoded.avast.io/threatintel/decryptor-for-atomsilo-and-lockfile-ransomware/

→https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/

→https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/

→https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader

→https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

Atomsilo

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Atomsilo