From OneNote to RansomNote: An Ice Cold Intrusion

In late February 2023, threat actors rode a wave of initial access using Microsoft OneNote files. In this case, we observed a threat actor deliver IcedID using this method. The threat actor used FileZilla to exfiltrate data from the network before deploying Nokoyawa ransomware.

https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/

access actor blueteamsec case cold data exfiltrate data february files filezilla ice icedid initial access intrusion microsoft microsoft onenote network nokoyawa nokoyawa ransomware onenote onenote files ransomware threat threat actor threat actors