FunkSecThreat actor
Funksec is a newly identified extortion group that has claimed 11 victims across various sectors, including media, IT, and education, operating a Tor-based DLS to centralize its ransomware activities. The group advertises a free DDoS tool and may develop its own ransomware binary, indicating significant technical capability.From MISP Galaxy
Last reported 1 month ago, by Palo Alto Unit 422 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1036Masquerading
“This specific ClickFix page was observed on four different URLs, but only the one masquerading Advanced IPScanner seems to deliver a fake installer, the others executing the PowerShell backdoor via an obfuscated loader.”
- T1684Social Engineering
“ClickFix is a social engineering technique where threat actors manipulate users into executing malicious commands by presenting fake system prompts or CAPTCHA verifications.”
- T1053.005Scheduled Task
“The Windows variant of the ransomware creates a scheduled task to be executed every day at 8:00 PM.”
- T1055.005Thread Local Storage
“The executable is protected by a custom packer and unpacked using a code stored in its Thread Local Storage.”
- T1056.001Keylogging
“The executables packed in this custom packer were indeed files related to keylogging activity and information stealer.”
- T1480Execution Guardrails
“In February 2025, this loader was improved with some interesting execution guardrails:”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution“The most represented family in our endpoint data is FunkSec, a ransomware strain that multiple researchers have assessed as partially generated with LLM assistance.”
-
Interlock Ransomware: Evolving Under the Radar with ClickFix“…intain relevance while avoiding the large-scale visibility associated with more prolific ransomware groups such as the attention-seeker FunkSec ransomware group.”
Indicators in its reports
named in the reports above- 1619bcad3785be31…3cb8964d4cb7in 1 report
- 5226ea8e0f516565…02c5b4ac6abdin 1 report
- dcf536edd67a9886…8af06cb036acin 1 report
- 66dbf939c00b09d8…f57b1ad047bdin 1 report
- c233aec7917cf342…3c08201a7a1cin 1 report
- e622f3b743c7fc0a…d582ca4cda22in 1 report
- b1ef7b267d887e34…c98cc74642fbin 1 report
- 20ed21bfdb7aa970…29d0e2a44e5din 1 report
- dd15ce869aa79884…2303e1ecd966in 1 report
- c398b3e06ef86067…bb2f094a14efin 1 report
- bb932056cae89407…085ae2b2baf7in 1 report
- 4fb58687a364c3f6…d424db1b1b14in 1 report
- sublime-forecasts-pale-scored.trycloudflare[.]comin 1 report
- washing-cartridges-watts-flags.trycloudflare[.]comin 1 report
- investigators-boxing-trademark-threatened.trycloudflare[.]comin 1 report
- fotos-phillips-princess-baker.trycloudflare[.]comin 1 report
- casting-advisors-older-invitations.trycloudflare[.]comin 1 report
- complement-parliamentary-chairs-hc.trycloudflare[.]comin 1 report
- hxxps://microsoft-msteams[.]com/additional-check.htmlin 1 report
- microsoft-msteams[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.