HTML Smuggling Leads to Domain Wide Ransomware

In this case a threat actor delivered a password protected ZIP file via HTML smuggling. Within the password protected ZIP file, there was an ISO file that deployed IcedID which led to the use of Cobalt Strike. Nokoyawa ransomware was deployed domain wide within 12 hours of initial access.

Report: [https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/](https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/)

access actor case cobalt cobalt strike domain file html html smuggling icedid initial access iso led malware nokoyawa nokoyawa ransomware password ransomware smuggling strike threat threat actor zip