Description Summary
Conti-codebase derived; has a 2026 CISA advisory (AA26-222A).
Threat Actor
Conti-codebase derived; initial access via Fortinet VPN MFA-bypass; RaaS affiliate program (2026).
Technical Indicators
Encryption Extension
.ENCRT
Encryption Algorithm
ChaCha20 + RSA-4096 with 'step-skip' partial encryption (C/C++)
Ransom Note Name
R3ADM3.txt
Targeted Industries
Manufacturing, Critical infrastructure (cross-sector)
First Seen
April 2025
Last Seen
Active (CISA AA26-222A, Aug 2026)
Geographical Location
Global
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |