kazu

Key insights

• •Targets include government agencies, public-sector institutions, and healthcare providers.
• •Initial access is typically gained through exploiting RDP services and unpatched web applications.
• •The group uses SmokeLoader as the initial loader to deliver ransomware payloads.
• •Employs a double-extortion tactic, exfiltrating data before encrypting files.
• •Ransom demands range from $60,000 to $500,000, with threats to publish stolen data.