APT / THREAT GROUP

Samas-Samsam

aliases

Intelligence Profile

Ransomware Targeted attacks -Jexboss -PSExec -Hyena

Threat Analysis

Samas-Samsam is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://download.bleepingcomputer.com/demonslay335/SamSamStringDecrypter.zip

→http://blog.talosintel.com/2016/03/samsam-ransomware.html

→http://www.intelsecurity.com/advanced-threat-research/content/Analysis_SamSa_Ransomware.pdf

→https://www.bleepingcomputer.com/news/security/new-samsam-variant-requires-special-password-before-infection/

→https://www.bleepingcomputer.com/news/security/samsam-ransomware-crew-made-nearly-6-million-from-ransom-payments/

→https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf

→https://id-ransomware.blogspot.com/2016/03/samsam.html

→https://www.ransomlook.io/group/samsam

Quick Facts

TypeAPT / Threat Group

Aliases9

Also Known As

MIKOPONI.exeshowmehowto.exeSamasSamsamsamsam.exeSamSam RansomwareSamas-SamsamSamSamRikiRafael.exe

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Samas-Samsam