Threat Intelligence Tarot
Vol. II · 125
Iran
★★★★★
risk 4/5
✦ The Mirage Locksmith ✦
Cobalt Mirage
DEV-0270 · TunnelVision · Mint Sandstorm subgroup
US municipalitiesIsraeli organizationsHealthcareEducation
Active since ~2020 · Espionage, Disruption, Opportunistic extortion
The Mirage Locksmith turns Microsoft's own locks against the building. BitLocker becomes hostage tape; the recovery key, a ransom note. The tools defenders trusted now ask them to pay.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Log4Shell exploitation against US municipalities (2022)
- ◆ProxyShell and Fortinet vulnerability exploitation
- ◆BitLocker abuse for ransomware-style extortion
- ◆Secureworks and Microsoft public attribution (2022)
Defenses
- ▸BitLocker recovery key escrow to Active Directory or Entra IDMicrosoft BitLocker Deployment Guide
- ▸Public-facing application patching SLAs with 0-day mitigationsCIS Control 7 ↗
- ▸Local administrator password solution (LAPS) for endpointsCIS Control 5 ↗
- ▸Incident response playbooks specifically covering encryption-for-extortionNIST SP 800-61 ↗
Reversed: Their Weakness
BitLocker recovery key escrow (in AD or Entra ID) defeats this operator's leverage entirely. Encryption you control is encryption they cannot weaponize.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.