HOMETHREATSSage 2.0 Ransomware
APT / THREAT GROUP

Sage 2.0 Ransomware

1
aliases

Intelligence Profile

It’s directed to English speaking users, therefore is able to infect worldwide. This ransomware attacks your MS Office by offering a Micro to help with your program, but instead incrypts all your files if the used id not protected. Predecessor CryLocker

Threat Analysis

Sage 2.0 Ransomware is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://id-ransomware.blogspot.co.il/2017/01/sage-2-ransomware.html
→https://isc.sans.edu/forums/diary/Sage+20+Ransomware/21959/
→http://www.securityweek.com/sage-20-ransomware-demands-2000-ransom
→https://www.bleepingcomputer.com/news/security/sage-2-0-ransomware-gearing-up-for-possible-greater-distribution/
→https://www.govcert.admin.ch/blog/27/sage-2.0-comes-with-ip-generation-algorithm-ipga

Quick Facts

TypeAPT / Threat Group
Aliases1

Also Known As

Sage 2.0 Ransomware

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Sage 2.0 Ransomware
Sage 2.0 Ransomware — APT / Threat Group | Threat Intelligence | CTIWATCH.COM