Kittykatkrew

MITRE ATT&CK does not currently catalogue Kittykatkrew, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: low. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: kittykatkrew executes malicious commands through PowerShell to stage payloads and manipulate system behavior.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1112 Modify Registry PersistenceDefense Impairment

   What they do: kittykatkrew modifies Windows Registry Run keys to establish persistence and ensure recurring execution.

   What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

3. T1685 Disable or Modify Tools Defense Impairment

   What they do: kittykatkrew disables antivirus tools by terminating security processes and modifying system configurations to evade detection.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

4. T1027.002 Software Packing Stealth

   What they do: kittykatkrew packs its malware binaries to evade static analysis and signature-based detection.

   What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.

5. T1070.004 File Deletion Stealth

   What they do: kittykatkrew deletes Volume Shadow Copies and backup directories via command execution to prevent data restoration.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

6. T1057 Process Discovery Discovery

   What they do: kittykatkrew discovers running processes using native API calls to identify services for disruption or privilege escalation.

   What that means: Adversaries may attempt to get information about running processes on a system.

7. T1486 Data Encrypted for Impact Impact

   What they do: kittykatkrew encrypts victim files using a custom ransomware payload to hold data hostage.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

8. T1489 Service Stop Impact

   What they do: kittykatkrew stops critical Windows services via scripts to disrupt system recovery and user access.

   What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

The note this group leaves on a compromised machine. Click a filename to read it.

!!! All your files are encrypted !!!

    Do not attempt to recover files on your own, as it can lead to a harder recovery process for us. It is pretty much impossible to decrypt the files without our decryptor.

    You will have to pay a ransom for files to be decrypted.

    How do you know we won't scam you? Well if we didn't decrypt your files, it would be a very bad image on our group.
    Therefore no one else would pay us, furthermore we can decrypt 3 files for free, as proof we have the ability to decrypt.

    You can contact us via TOR, you download it at https://www.torproject.org/

    Once you download TOR, please fill the relevant information here: http://jzdonx6ak2swiitotgajdfh3wjpvyunpi3hatte343dvw4nw4vv2ayqd.onion/

    You will have to enter a decryption key, which is right here: [SNIP]

Ransom-note text from RansomLook, licensed CC BY 4.0.