Informations concernant les rançongiciels LockerGoga et Ryuk

ANSSI bulletin (26 Mar 2019) describing a series of ransomware attacks involving LockerGoga and Ryuk: includes technical analysis of samples, ransom notes, scripts (kill.bat), attacker infrastructure (IP addresses, ASNs, malicious URLs), TTPs (initial access via exposed services, use of Metasploit/Cobalt Strike/Empire, RDP lateralization, PsExec for deployment), links to Grim Spider activity, and extensive IOCs (hashes, certs, URLs) to support detection and mitigation.