HOMETHREATSRanbyus
APT / THREAT GROUP

Ranbyus

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.ranbyus

Threat Analysis

Ranbyus is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.xylibox.com/2013/01/trojanwin32spyranbyus.html
→https://bin.re/blog/ranbyuss-dga-revisited/
→https://bin.re/blog/the-dga-of-ranbyus/
→https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf
→https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Ranbyuswin.ranbyus

External Intelligence

Malpedia: win.ranbyus

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Ranbyus