SpnDump (03e4d22a-83f5-46d9-9d40-d9c58a65d2cb)
SpnDump is used to list service principal name identifiers, which Ghost actors use for service and hostname enumeration.[U.S. CISA Ghost Cring Ransomware February 19 2025]
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| SpnDump (03e4d22a-83f5-46d9-9d40-d9c58a65d2cb) | Tidal Software | Ghost Ransomware Actors (9dc09b70-b1c0-45d1-94a8-490943c69166) | Tidal Groups | 1 |