Play ransomware is using a familiar Windows-administration disguise to reduce suspicion during intrusions: a custom service binary named PSexesvc.exe. The group’s use of a custom service binary named PSexesvc.exe, mimicking Microsoft Sysinternals PsExec, illustrates how attackers can turn routine Windows administration into cover for lateral movement and payload execution. The binary has been observed alongside […]
The post Play Ransomware Masquerades as PsExec to Blend Into Legitimate Windows Administration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.