APT / THREAT GROUP

Merry Christmas

aliases

Intelligence Profile

It’s directed to English and Italian speaking users, therefore is able to infect worldwide. Most attacks are on organizations and servers. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. They pose as a Consumer complaint notification that’s coming from Federal Trade Commission from USA, with an attached file called “complaint.pdf”. Written in Delphi by hacker MicrRP.

Threat Analysis

Merry Christmas is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://id-ransomware.blogspot.co.il/2016/12/mrcr1-ransomware.html

→https://www.bleepingcomputer.com/news/security/-merry-christmas-ransomware-now-steals-user-private-data-via-diamondfox-malware/

→http://www.zdnet.com/article/not-such-a-merry-christmas-the-ransomware-that-also-steals-user-data/

→https://www.bleepingcomputer.com/news/security/merry-christmas-ransomware-and-its-dev-comodosecurity-not-bringing-holiday-cheer/

→https://decrypter.emsisoft.com/mrcr

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

Merry ChristmasMRCRMerry X-Mas

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Merry Christmas