Name this adversary
Their role Ransomware crew Buys access, moves fast, wants the estate unusable by morning. Disgruntled insider Already has an account and a badge; everything they do looks routine. State-sponsored operator Patient, tooling written for the target, happy to sit for months. Commodity criminal Off-the-shelf kit, sprays the internet, takes whatever answers. Hacktivist Wants the story, not the money. Noise is part of the point. Contracted red team Scoped, documented and deliberately detectable at the end. Tactics they favor Reconnaissance and discovery Sweeps the range and reads the directory before committing to anything. Phished or bought access The way in is a person or an account somebody else already opened. Scripted execution Work is done in the shell that is already installed. Blind the logging Turns the sensors off before the loud part starts. Take credentials Accounts first; everything afterwards looks like ordinary work. Move machine to machine Remote desktop and admin shares between hosts. Ship the data out Out over a service the estate already allows. Break something Encryption or destruction as the closing act.
What is in their kit Credential dumper Reads secrets straight out of memory on whatever they land on. Remote execution utility Service and admin-share execution between machines. Phishing kit Themed lure with a hosted credential page behind it. Network scanner Sweeps the range for what answers and who is in the directory. Cloud sync client Moves data out over an allowed service so it looks like work. Living off the land Built-in shells and admin tools only; nothing to detonate on disk. Ransomware builder Encrypts on a schedule and drops a note per share. Password spray tool One password against every account, slowly enough to dodge lockout. What they are after Harvest credentials They want accounts, not files — the rest follows from that. Exfiltrate data The win condition is a copy of the data leaving the estate. Deploy ransomware Spread wide first, encrypt once, all at the same time. Hold long-term access Quiet footholds and blinded logging beat a fast smash. Disrupt operations Anything that stops the business counts as success. Map the estate A reconnaissance pass, sold on or used later. 
CYBRARY