Oddbean new post about login | logout BlackCat ransomware group claiming responsibility for #MGM Resorts hack. Says vxunderground, TI industry and press got it wrong. #threatintel https://cyberplace.social/system/media_attachments/files/111/065/886/662/975/583/original/b90917b150a215e1.jpeg https://cyberplace.social/system/media_attachments/files/111/065/886/723/251/206/original/3cc6b4890f983086.jpeg https://cyberplace.social/system/media_attachments/files/111/065/886/793/129/556/original/bf710140b0684027.jpeg https://cyberplace.social/system/media_attachments/files/111/065/886/854/308/762/original/e16ea0e5ad38b8a7.jpeg
For what it’s worth, their statement lines up with what I monitored - i.e. MGM still had IIS servers etc online when this incident began, but on the dates they’re talking about almost everything plunged offline.
This is also a good write up on the MGM thing: https://www.bleepingcomputer.com/news/security/mgm-resorts-esxi-servers-allegedly-encrypted-in-ransomware-attack/
@f7d0478e is scattered spider under black cat? I'm seeing both names used kinda interchangeably
