Ransomware Indicators added to RSA LIVE

[Anonymous]

You asked and we listened! 

Ransomware continues to be a significant threat to our customers, so this is a very timely addition.  Abuse.ch has added a ransomeware tracker which tracks the following families of ransomware:

TeslaCrypt

CryptoWall

TorrentLocker

PadCrypt

Locky

CTB-Locker

FAKBEN

PayCrypt

We’ve added these indicators to the following feeds in LIVE:

Third Party IOC Domains

Third Party IOC IPs

They can be located with the following pivot in the Security Analytics UI:

Threat.category = “abuse.ch ransomware”

Happy Hunting!

RSA-FirstWatch

[Udupikrishna]

Is this Threat category still active?, what i see now on 10.6.3 is there's category called just "ransomware" not "abuse.ch ransomware".

I see more families as well, Cerber is one of them not mentioned in the above blog. I was building a use case  based on the threat category and i wanted to double check if i am supposed to be using "ransomware" or the one with abuse.ch

Thanks in advance

[ShahnawazKohati]

RSA,

Can we have response on "Udupi krishna" post.

This is critical.