Two ransomware crews hitting city hall both phish, use valid accoun…

Question

Two ransomware crews hitting city hall both phish, use valid accounts, then encrypt, but they use different lure text and encryptors. How should the industry regard those TTPs?

Accepted Answer

As reusable behavioral patterns: the tactics and techniques can be shared even when each crew's procedures differ — Same playbook, different jerseys. Phish, valid accounts, encrypt is a reusable pattern—the lure wording and encryptor hash are just this week's procedure, not a brand-new sport.

Answer

As unique hashes only: if the encryptor file hash changes, the entire TTP set is a new attack class

Answer

As a single civic incident number that cannot be reused across crews

Answer

As Kill Chain stages that forbid mapping the same technique to more than one actor

Two ransomware crews hitting city hall both phish, use valid accounts, then encrypt, but they use different lure text and encryptors. How should the industry regard those TTPs?

Short Explanation

Full Explanation