Description Summary
250+ victims by late 2025; one of the most affiliate-friendly RaaS panels.
Threat Actor
RaaS — $250 entry, 88% affiliate split; Tor panel + builder; access via AWS S3 misconfig, weak IAM, legacy RDP.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
Custom AES-256 via a lightweight loader (Advapi32 manipulation for AV evasion)
Ransom Note Name
Not publicly reported
Targeted Industries
Healthcare, Financial services, Government
First Seen
Oct 2023 (hacktivist) → RaaS June 2024
Last Seen
Active (250+ victims)
Geographical Location
Global
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |