SenSayQ

MITRE ATT&CK does not currently catalogue SenSayQ, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: low. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: SenSayQ executes malicious commands via PowerShell scripts embedded in its deployment chain.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: SenSayQ uses registry run keys to ensure persistence after reboots.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

3. T1685 Disable or Modify Tools Defense Impairment

   What they do: SenSayQ disables security tools such as antivirus and monitoring agents to evade detection.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

4. T1070.004 File Deletion Stealth

   What they do: SenSayQ deletes critical files and artifacts like backups or shadow copies before encryption.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

5. T1110 Brute Force Credential Access

   What they do: SenSayQ attempts brute-force attacks on local accounts to gain initial system access.

   What that means: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

6. T1135 Network Share Discovery Discovery

   What they do: SenSayQ discovers network shares to identify additional victims for lateral spread.

   What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

7. T1486 Data Encrypted for Impact Impact

   What they do: SenSayQ encrypts victim files using its own ransomware payload to hold data hostage.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

8. T1490 Inhibit System Recovery Impact

   What they do: SenSayQ disrupts system recovery by disabling backup restoration and volume shadow copy mechanisms.

   What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

The note this group leaves on a compromised machine. Click a filename to read it.

Dear managment!

---Welcome! Your are locked by SenSayQ!---

If you are reading this message, means that:

  * Your network infrastructures have been compromized!
  * Critical data has leaked!
  * Files are encrypted!
    

-----------------------------------------------------------------------
The best and only thing you can do is to contact us to settle the matter before any losses occurs. 
-----------------------------------------------------------------------

1. If you modify files - our decrypt software won't able to recover data.
2. If you use third party software - you can damage/modify files (see item 1). 
3. You need cipher key / our decrypt software to restore you files. 
4. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.


Contacting us will be the fastest and safest solution to the problem.

-----------------------------------------------------------------------

Attention! If you do not contact us within 72 hours, we will be forced to publish the stolen data on our website.


To contact us:

1. Download and install Tor Browser - torproject.org/download
2. Follow the link: ppzmaodrgtg7r6zcputdlaqfliubmmjpo4u56l3ayckut3nyvw6dyayd.onion
3. Enter your ID: [snip]


E-mail support: [email protected]

Ransom-note text from RansomLook, licensed CC BY 4.0.