Threat Intelligence Directory

#MakeIsraelGreatAgain

encrypthub — tracked by MISP Galaxy (ransomware).

Ransomware

Ransomware

Ransomware

No detailed intelligence profile available.

Ransomware

ransomware

Ransomware

ransomware

Ransomware

Ransomware

Ransomware

Ransomware RaaS

Ransomware

grep — tracked by MISP Galaxy (ransomware).

No detailed intelligence profile available.

aka Cring / Ghost (Cring) <br/> <br/>Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware. This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China. Ghost actors, located in China, conduct these widespread attacks for financial gain. Affected victims include critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small- and medium-sized businesses. <br/> <br/>Ghost actors rotate their ransomware executable payloads, switch file extensions for encrypted files, modify ransom note text, and use numerous ransom email addresses, which has led to variable attribution of this group over time. Names associated with this group include Ghost, Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture. Samples of ransomware files Ghost used during attacks are: Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe. <br/> <br/>https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a

No detailed intelligence profile available.

Ransomware

Crylock — tracked by MISP Galaxy (ransomware).

arcus media — tracked by MISP Galaxy (ransomware).

ransomware

OnePercent Group is a cybercriminal operation active since at least November 2020 that targeted US organizations using phishing with IcedID trojans, Cobalt Strike, and double-extortion, threatening a "one percent leak" of data before escalating to a full dump or sale to REvil; the FBI issued a formal flash advisory in August 2021.

xollam — tracked by MISP Galaxy (ransomware).

Ransomware

Ransomware

octovillan — tracked by MISP Galaxy (ransomware).

No detailed intelligence profile available.

Ransomware

ransomware

Ransomware

Chort is a double-extortion ransomware group (whose name means "Devil" in Russian) that emerged in October 2024, primarily targeting US education and government sectors, with notable victims including the City of Sheboygan and Kuwait's Ministry of Finance.

ransomware

ransomware

[Frankenstein](https://attack.mitre.org/groups/G0101) is a campaign carried out between January and April 2019 by unknown threat actors. The campaign name comes from the actors' ability to piece together several unrelated components.(Citation: Talos Frankenstein June 2019)

Mallox — tracked by MISP Galaxy (ransomware).

About: This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..

This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..

Cheers is a Linux-based ransomware group that emerged in 2022, built on leaked Babuk source code and specializing in attacks against VMware ESXi servers, running a double-extortion leak site with four documented victims.