Proven Data (@Proven_Data) | teapawt

Pinned Tweet

Proven Data@Proven_Data3 Jun 2024

Cyber threats are increasing, and knowing how to respond immediately will determine whether your business survives an attack. Get your business ready with our Incident Response guide: bit.ly/44UGYBh #ransomwareattack #cybersecurity

1

282

Proven Data@Proven_Data7h

The highest-signal Chaos RaaS observable is not a hash: an inbound mail flood followed by an unscheduled Quick Assist session the same day. Full profile + IOCs: provendata.com/blog/chaos-ra… #DFIR #ThreatDetection #Ransomware #CyberDefense #CyberSecurity

Chaos Ransomware Threat Profile

Understand the Chaos RaaS operation (and how to tell it apart from the 2021 builder). Get the attack chain, IOCs, MITRE ATT&CK mapping, and IR guidance.

18

Proven Data@Proven_DataOct 19

LockBit 3.0 ran quadruple extortion: encryption, exfiltration, DDoS, and direct victim harassment. No public decryptor for post-Feb 2024 victims. provendata.com/blog/lockbit3… #CyberSecurity #Ransomware #DFIR #IncidentResponse #CISO #InfoSec

LockBit 3.0 (LockBit Black) Ransomware Technical Analysis

LockBit 3.0 claimed over 2,000 victims across 95 countries. Get the full attack chain, MITRE ATT&CK mapping, IOCs, and IR checklist for security teams and MSPs.

33

Proven Data@Proven_DataOct 16

Booba Project ransomware has hit hospitals, county governments & schools since Sept. 22, with no public decryptor and an unconfirmed entry vector. Full breakdown: provendata.com/blog/booba-pr… #Ransomware #CyberSecurity #DFIR #InfoSec #IncidentResponse

Booba Project Ransomware: Profile, IOCs, and Incident Response

Booba ransomware (Booba Project) steals data before encrypting it. Learn who it targets, its IOCs, and what to do if it hits your network.

39

Proven Data@Proven_DataOct 15

INC ransomware hit 885 claimed victims by Aug 2026, now exploiting a pre-auth SonicWall SMA1000 flaw for VPN compromise. No public decryptor exists. Full breakdown: provendata.com/blog/inc-rans… #CyberSecurity #Ransomware #DFIR #InfoSec #IncidentResponse #SonicWall

INC Ransomware: Tactics, Evolution, and Incident Response Guide

INC ransomware has surged as a dominant RaaS operation in 2026. Get the updated attack chain, Lynx lineage, MITRE ATT&CK mapping, IOCs, and IR guidance.

54

Proven Data@Proven_DataOct 13

MOAB compiled 26B records from thousands of breaches. Credential stuffing using that data remains a top entry point for ransomware. provendata.com/blog/mother-o… #CyberSecurity #MFA #PasswordSecurity #ZeroTrust #Ransomware

Mother of All Breaches (MOAB): What Happened to the 26 Billion Leaked Records

The Mother of All Breaches (MOAB) exposed 26 billion records in January 2024. See what leaked, whether it still holds the record in 2026, and how to respond.

1

23

Proven Data@Proven_DataOct 9

Disabled security tools, deleted shadow copies, and payloads staged on admin shares: when these cluster within minutes, treat it as an active ransomware deployment. Full CRPxO IOC and ATT&CK breakdown: provendata.com/blog/crpxo-ra… #DFIR #Ransomware #CyberSecurity #IncidentResponse

CRPxO Ransomware: Attack Chain, IOCs, and MITRE ATT&CK TTPs

CRPxO is a 2026 extortion operation pairing ClickFix delivery with crypto theft and double extortion. Get the attack chain, IOCs, MITRE ATT&CK mapping, and IR guidance.

20

Proven Data@Proven_DataOct 8

The Gentlemen ransomware listed 923 victims in 90 countries, entering through FortiOS CVE-2024-55591 and VPNs without MFA. Full breakdown: provendata.com/blog/gentleme… #CyberSecurity #Ransomware #DFIR #InfoSec #IncidentResponse #ThreatIntel

Gentlemen Ransomware: Tactical Analysis of a High-Velocity RaaS Operation

The Gentlemen ransomware explained: Go encryptor, BYOVD EDR-killing, GPO-based deployment, IOCs, MITRE ATT&CK mapping, and what to do if you are hit.

76

Proven Data@Proven_DataOct 6

Rhysida uses AzCopy to move stolen data into Azure storage it controls. The transfer is invisible until the leak-site listing appears. Full breakdown: provendata.com/blog/rhysida-… #Ransomware #DFIR #IncidentResponse #ThreatHunting #CyberSecurity

Rhysida Ransomware: Attack Chain, IOCs, and Recovery Options

Rhysida ransomware encrypts Windows and ESXi and auctions stolen data. Get its attack chain, IOCs, ATT&CK mapping, detection signals, and recovery options.

64

Proven Data@Proven_DataOct 5

MedusaLocker encryption is the final phase, not the first. Access typically precedes payload deployment by weeks. Full investigation guide: provendata.com/blog/medusalo… #CyberSecurity #Ransomware #DFIR #IncidentResponse #ThreatIntel #MedusaLocker

MedusaLocker Ransomware: What You Need to Know

MedusaLocker is an RDP-driven RaaS active since 2019. Full attack chain, IOCs, MITRE ATT&CK mapping, and IR guidance, and why it is not Medusa.

22

Proven Data@Proven_DataOct 2

Cybersecurity Awareness Month 2026 is here. Most training skips the real entry points: stolen creds, MFA abuse, and vishing. The 4-week plan: provendata.com/blog/cybersec… #CyberAwarenessMonth #CyberSecurity #DFIR #MSP #InfoSec

Cybersecurity Awareness Month: Your Guide to Staying Safe Online

Cybersecurity Awareness Month 2026 runs from October 1 to 31. Get the CISA and NCA themes, plus a 4-week security plan that MSPs and IT teams can run with users.

22

Proven Data@Proven_DataOct 1

DeadLock resolves its ransom negotiation proxy live via Polygon smart contracts. No public decryptor exists for the current build. provendata.com/blog/deadlock… #Ransomware #CyberSecurity #Blockchain #InfoSec #ThreatActor

DeadLock Ransomware: Attack Lifecycle, TTPs, IOCs, and Response

DeadLock ransomware: BYOVD kernel EDR evasion, Polygon-backed negotiation, double extortion. Full attack lifecycle, IOCs, ATT&CK mapping, and IR guidance.

47

Proven Data@Proven_DataSep 30

Chaos RaaS: email flood, fake IT call, Quick Assist. Every persistence and exfil tool is commercially signed. EDR fires on none of it. Full profile + IOCs: provendata.com/blog/chaos-ra… #DFIR #Ransomware #CyberSecurity #ThreatIntel #IncidentResponse

Chaos Ransomware Threat Profile

Understand the Chaos RaaS operation (and how to tell it apart from the 2021 builder). Get the attack chain, IOCs, MITRE ATT&CK mapping, and IR guidance.

1

41

Proven Data@Proven_DataSep 28

From FBI retaliatory defacements to cloud vishing: Our latest threat analysis breaks down the #ShinyHunters group's tactics and high-profile campaigns. Full analysis: provendata.com/blog/shinyhun… #Cybersecurity #ThreatIntel #IncidentResponse #ShinyHunters

ShinyHunters: Attack Lifecycle, IOCs, and Incident Response Guide

ShinyHunters threat analysis: how the group steals data through vishing, OAuth token abuse, and a PeopleSoft zero-day, plus IOCs and incident response steps.

32

Proven Data@Proven_DataSep 23

Genesis Market was taken down in 2023. Genesis ransomware was not. Two groups, one name, entirely different defensive responses. Full breakdown: provendata.com/blog/genesis-… #Ransomware #ThreatActor #SecurityOperations #CyberThreats #InfoSecCommunity #SOC

Genesis Ransomware: Threat Actor Profile

Genesis ransomware is an active double-extortion group with 111 claimed victims since October 2025. Full attack chain, sector targeting, MITRE ATT&CK mapping, and IR guidance for security teams.

17

Proven Data@Proven_DataSep 22

Storm ransomware: 56 victims, 5 countries, 39 days. No vendor has confirmed a single intrusion technique or malware sample. Full analysis: provendata.com/blog/storm-ra… #Ransomware #DFIR #CyberSecurity #ThreatIntel #IncidentResponse

Storm Ransomware Threat Analysis

Storm is a ransomware group that emerged in August 2026 and listed 60+ victims in a month. Get the threat profile, probable TTPs, IOCs, and IR guidance.

37

Proven Data@Proven_DataSep 14

Password-only VPN access is still one of the top ransomware entry points. BlackSuit went from brute force to full encryption in 9 days. Full technical analysis and IOCs here: provendata.com/blog/blacksui… #DFIR #MFA #CyberSecurity #ZeroTrust #BlackSuit

BlackSuit Ransomware: Full Technical Analysis

BlackSuit ransomware breached a network through a password-only VPN account and reached enterprise-wide encryption in nine days. See the full attack chain, MITRE ATT&CK mapping, and IOCs from a...

2

57

Proven Data@Proven_DataSep 10

Play ransomware doesn't use the same malware twice. Every victim gets a unique compiled payload. AV signatures can't flag what they've never seen. IOCs + hardening checklist: provendata.com/blog/play-ran… #CyberSecurity #Ransomware #DFIR #EndpointSecurity #ThreatDetection

Play Ransomware: IOCs, Attack Chain & IR Guide | Proven Data

Play ransomware (PlayCrypt) has confirmed 900+ victims across 44 countries. IOCs, MITRE ATT&CK mapping, ESXi variant analysis, and IR checklist.

1

58

Proven Data@Proven_DataSep 8

No public decryptor exists for current Akira ransomware variants. VSS deletion on Windows and total per-datastore loss on ESXi define the recovery math. provendata.com/blog/akira-ra… #Ransomware #DFIR #CyberSecurity #DataRecovery #Akira

Akira Ransomware: Detection, Prevention, and Recovery

Deep-dive into Akira ransomware tactics, attack vectors, and real-world defense strategies, including detection methods and data recovery options.

1

53

Proven Data@Proven_DataSep 3

CRPxO ransomware hit dozens of US orgs via ClickFix lures, hijacking clipboards and harvesting crypto seed phrases before encryption. Full IOCs + ATT&CK mapping: provendata.com/blog/crpxo-ra… #Ransomware #DFIR #InfoSec #CyberSecurity #IncidentResponse #ClickFix

CRPxO Ransomware: Attack Chain, IOCs, and MITRE ATT&CK TTPs

CRPxO is a 2026 extortion operation pairing ClickFix delivery with crypto theft and double extortion. Get the attack chain, IOCs, MITRE ATT&CK mapping, and IR guidance.

40

Proven Data@Proven_DataSep 1

MedusaLocker: 88 victims, 22 countries, active through August 2026. RDP primary entry. Steals first, no decryptor. Full profile: provendata.com/blog/medusalo… #CyberSecurity #Ransomware #DFIR #IncidentResponse #ThreatIntel #MedusaLocker

MedusaLocker Ransomware: What You Need to Know

MedusaLocker is an RDP-driven RaaS active since 2019. Full attack chain, IOCs, MITRE ATT&CK mapping, and IR guidance, and why it is not Medusa.

1

89