Description Summary
RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.
Threat Actor
Actor GOLD DUPONT (aka Defray777 / Ransom X); Windows + Linux; fileless/memory deployment.
Technical Indicators
Encryption Extension
.ransomexx / victim-specific
Encryption Algorithm
AES + RSA; RansomEXX2 variant written in Rust
Ransom Note Name
Not publicly reported
Targeted Industries
Government, Technology, Manufacturing
First Seen
2018
Last Seen
Active / evolving (2025)
Geographical Location
Global
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |