Malvertising schemes have been used by the Storm-0216 threat operation, also known as UNC2198 and Twisted Spider, to deploy the Danabot malware to achieve initial systems access before proceeding with the distribution of Cactus ransomware since last month, reports The Record, a news site by cybersecurity firm Recorded Future. “Danabot collects user credentials and other info that it sends to command and control, followed by lateral movement via Remote Desktop Protocol (RDP) sign-in attempts, eventually leading to a handoff to Storm-0216,”

Source: SC Magazine