Threat Intelligence Directory

PlayBoy Locker is a ransomware-as-a-service operation that emerged in September 2024, targeting Windows, NAS, and ESXi systems across multiple sectors on an 85/15 affiliate revenue split; its source code was reportedly sold underground by late 2024.

A new distribution campaign is underway for a STOP Ransomware variant called KeyPass based on the amount of victims that have been seen. Unfortunately, how the ransomware is being distributed is unknown at this time.

Ransomware

This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware poses at MSOffice to fool users into opening the infected file. GO Ransomware

ransomware

captcha prevents indexing

Freezing crypto ransomware encrypts user data using AES, and then requires a ransom in # BTC to return the files. Original title: not indicated in the note. The file says: FreeMe.exe

ransomware

Ransomware

BlackShadow is a state-aligned cybercrime group reportedly linked to Iran’s cyber operations, first identified in late 2020. Their operations blend data exfiltration with ransom threats, notably targeting Israeli organizations such as Cyberserve—a web hosting provider—and leaking data to inflict reputational damage. Victims included entities like Atraf (an LGBTQ dating app), tour booking services, and museums, reflecting political or ideological motivations over financial gain. Despite carrying out extortion, there is no evidence that BlackShadow employs typical encryption-based ransomware mechanics; instead, they leverage stolen data and the threat of public exposure.

Ransomware

Ransomware

Ransomware

Ransomware

No detailed intelligence profile available.

ransomware

Ransomware

grinch — tracked by MISP Galaxy (ransomware).

ransomware

ransomware

A group which seems to recycle leak from other ransomware groups

Ransomware

crazyhunter team — tracked by MISP Galaxy (ransomware).

No detailed intelligence profile available.

No detailed intelligence profile available.

paradise2 — tracked by MISP Galaxy (ransomware).

cipherwolf — tracked by MISP Galaxy (ransomware).

ransomware

ransomware

Quantum ransomware, active from mid-2021 through 2022, was a rebrand of the MountLocker/AstroLocker/XingLocker lineage that operated as RaaS, known for extremely fast attack timelines (under four hours from initial access to encryption) and ransom demands ranging from $150,000 to multi-million dollars.

KageNoHitobito — tracked by MISP Galaxy (ransomware).

Ransomware

ransomware

Ransomware

Ransomware

Ransomware

ransomware

ransomware

This group is believed to be connected to Lost Trust. El Dorado rebranded to BlackLock in September 2024.

No detailed intelligence profile available.