Threat Intelligence Directory

Ransomware

ransomware

Ransomware EXE was replaced to neutralize threat

Risen, which is a fully optimized and high-speed program, is the result of our years of experience in the field of malware writing. Risen is written in C language and completely using winapi. We produced many products with different features and options, but we came to the conclusion that none of the options have the benefit and efficiency they should; So, instead of spending time on useless and inefficient options, we decided to spend all our time on the strength, speed and security of our cryptography, and that's how we created Risen. Software features in version 1: <br/> <br/> <br/> -Encryption security, utilizing Chacha20 and RSA 2048 algorithms. <br/> -High encryption speed and software optimization <br/> -compatible with all versions of Windows on any hardware without any issues. <br/> -Automatic option settings, its easy to using and default configuration set to the best mode. <br/> -Utilization of Threadpool method and queue creation for encryption. <br/> -A powerful file unlocker, unlock files without closing processes. <br/> -Safe deletion of backups, shadow copies, and all windows logs. <br/> -A blog, Leak website, and management panel on TOR for leaking data of non-paying companies. <br/>

Uses http://ccrypt.sourceforge.net/ encryption program

redact — tracked by MISP Galaxy (ransomware).

Ransomcartel — tracked by MISP Galaxy (ransomware).

No detailed intelligence profile available.

No detailed intelligence profile available.

Ransomware

Ransomware CrypBoss Family

Bluebox is a data extortion group that emerged in December 2024, employing double-extortion tactics against victims primarily in France, Sweden, and the French Caribbean, and threatening to notify data protection authorities to add regulatory pressure on victims.

No detailed intelligence profile available.

It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. These hackers claim to be students from Syria. This ransomware poses as the popular torrent movie screener called PopCorn. These criminals give you the chance to retrieve your files “for free” by spreading this virus to others. Like shown in the note bellow: https://www.bleepstatic.com/images/news/ransomware/p/Popcorn-time/refer-a-friend.png

Connected to GD Lockersec and Babuk-Bjorka. <br/> <br/>Group is aka SalanLock (from typo on victim pages).

A targeted email campaign has been spotted distributing the JasperLoader to victims. While the JasperLoader was originally used to then install Gootkit, Certego has observed it now being used to infect victims with a new ransomware dubbed FTCODE. Using an invoice-themed email appearing to target Italian users, the attackers attempt to convince users to allow macros in a Word document. The macro is used to run PowerShell to retrieve additional PowerShell code.

ransomware

No detailed intelligence profile available.

ransomware

ransomware

ransomware

radiant group — tracked by MISP Galaxy (ransomware).

ransomware

Sabbath (also known as 54BB47h, operated by UNC2190) is a ransomware group active from mid-2021 that emerged as a rebrand of the Arcane ransomware, targeting critical infrastructure in the US and Canada — particularly hospitals, schools, and natural resources — using double extortion, backup destruction, and affiliate recruitment on Russian-language dark web forums.

ransomware

ransomware

Ransomware

LockBit 3.0 ("LockBit Black"), active since June 2022, is the third iteration of the LockBit RaaS platform incorporating code from BlackMatter ransomware, featuring modular encrypted payloads that evade analysis and targeting Windows and VMware ESXi environments across all sectors globally.

malphas — tracked by MISP Galaxy (ransomware).

ransomware

login page, no posts

No detailed intelligence profile available.

LockBit 2.0 is the second major iteration of the LockBit RaaS platform, launched in mid-2021, introducing automated domain-wide encryption via Active Directory Group Policy and claiming the fastest encryption speed among ransomware families, accounting for 46% of ransomware breach events in early 2022.

ransomware

This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. CryptoLocker Copycat

It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. CryptoShield 1.0 is a ransomware from the CryptoMix family.

ransomware

Ransomware

Ransomware Based on EDA2

Ransomware