Description Summary
~113 victims Dec 2024–Mar 2025; now DEFUNCT with a free decryptor released (Avast + law enforcement).
Threat Actor
Heavily AI/LLM-assisted tooling; single Rust binary disables 50+ processes; double extortion.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
ChaCha20 + Poly1305 via orion-rs 0.17.7 (Rust); files grow ~37%
Ransom Note Name
Not publicly reported
Targeted Industries
Cross-sector (per leak-site victim telemetry)
First Seen
December 2024
Last Seen
DEFUNCT (~March 2025; free decryptor available)
Geographical Location
Global / not publicly profiled
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |