LockBit Ransomware Abuses Windows Defender to Deploy Cobalt Strike Payload
A threat actor associated with the LockBit 3.0 ransomware-as-a-service (RaaS) operation has been observed abusing the Windows Defender command-line tool to decrypt and load Cobalt Strike payloads.
According to a report published by SentinelOne last week, the incident occurred after obtaining initial access via the Log4Shell vulnerability against an unpatched VMware Horizon Server.
Hey there, thanks for visiting our page. Listen, we get it, the information above may not be enough for you, and that's probably because the article originated somewhere else on the internet. So if you yearn for more reading, you can find the original write up HERE