Skip to content
brandefense.io
Request A Demo
RansomwareFinancialIntermediate sophistication

Obscura

Obscura is a ransomware group with a financial motive, tracked by Brandefense. It targets the Construction and Real Estate sector in 3 countries, including the United States and Thailand. It uses 15 MITRE ATT&CK techniques.

Request IOC feedRequest ATT&CK export
Techniques
15
Exploited CVEs
No CVE data
Record updated

Who They Target.

Sectors · 1
Countries · 3

How They Operate · MITRE ATT&CK.

15 techniques across 9 of 14 tactics

Reconnaissance·

Resource Development·

Initial Access4

T1021.001
Remote Services: Remote Desktop Protocol
T1078
Valid Accounts
T1133
External Remote Services
T1190
Exploit Public-Facing Application

Execution2

T1072
Software Deployment Tools
T1574.002
Hijack Execution Flow: DLL Side-Loading

Persistence1

T1546.015
Event Triggered Execution: Component Object Model Hijacking

Privilege Escalation1

T1068
Exploitation for Privilege Escalation

Defense Evasion2

T1490
Inhibit System Recovery
T1562.001
Impair Defenses: Disable or Modify Tools

Credential Access1

T1003
OS Credential Dumping

Discovery1

T1018
Remote System Discovery

Lateral Movement·

Collection·

Command and Control·

Exfiltration1

T1041
Exfiltration Over C2 Channel

Impact2

T1486
Data Encrypted for Impact
T1489
Service Stop

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →
CVE-2021-44228Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.ExploitedcriticalCVE-2024-57726SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions.ExploitedcriticalCVE-2023-22515Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and…ExploitedcriticalCVE-2023-22518Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker.ExploitedcriticalCVE-2023-22527Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.ExploitedcriticalCVE-2021-26855Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.ExploitedcriticalCVE-2024-21887Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products…ExploitedcriticalCVE-2023-46805Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that…ExploitedhighCVE-2024-21893Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the…ExploitedhighCVE-2024-21412Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.ExploitedhighCVE-2017-0199Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files.ExploitedhighCVE-2023-38831RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.ExploitedhighCVE-2024-57727SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp…ExploitedhighCVE-2024-57728SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e.Exploitedhigh

Arsenal · Malware And Tools.

  • 01flipmalware
  • Akira ransomwaremalware
  • Babukmalware
  • Bumblebeemalware
  • GuLoadermalware
  • INC Ransomwaremalware
  • KillAVmalware
  • Kronosmalware
  • LockBit 2.0malware
  • Lynxmalware
  • Makopmalware
  • Obscuramalware
  • POORTRYmalware
  • SectopRATmalware
  • Sicarii Ransomwaremalware
  • Warlockmalware
  • MeshAgenttool
  • Mimikatztool
  • NetExectool
  • Netscantool
  • Rclonetool
  • RustDesktool
  • SonicWall SSL VPNtool
  • Throttlestop Drivertool
  • Velociraptor DFIR tooltool
  • Windows CardSpace User Interface Agenttool

About Obscura.

Obscura is a ransomware strain observed in 2025, written in Go and specifically targeting Windows domain controllers via the SYSVOL/NETLOGON share, using Curve25519 + XChaCha20 encryption with double-extortion tactics and a 10-day payment deadline.

Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.