Water Bakunawa is a cybercriminal group exploiting Zerologon and using EDRKillShifter for evasion.
Analyst brief
Water Bakunawa is a cybercriminal group identified by Trend Micro. They target water and wastewater, IT, healthcare, and financial services sectors. The group exploits the Zerologon vulnerability for initial access and uses EDRKillShifter with advanced anti-EDR techniques to evade detection. Defenders should focus on applying patches for Zerologon, hardening EDR systems, and monitoring for RansomHub ransomware IoCs.
Water Bakunawa
unknown
Water Bakunawa is a cybercriminal group identified by Trend Micro, responsible for the RansomHub ransomware, which exploits the Zerologon vulnerability to gain unauthorized network access. The group employs EDRKillShifter to evade detection and disrupt security monitoring processes, utilizing advanced anti-EDR techniques. Their targets include sectors such as water and wastewater, IT, healthcare, and financial services. Members of the group and related affiliates have linked by association with other high-profile RaaS groups like Scattered Spider and ALPHV.