good dayMalware
Good Day is a ransomware variant within the ARCrypter family, first observed in May 2023. It gained prominence due to its reticent financial extortion model and custom branding—victims are greeted with a “Good day” message upon landing on individualized Tor-based victim portals. The malware is typically delivered via phishing campaigns disguising payloads as legitimate Windows updates.From MISP Galaxy
Last reported 5 months ago, by Huntress2 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1219Remote Access Tools
“Sliver beacons and remote access tools can be used for persistence”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Panic at the Distro“It’s never a good day for administrators when a branded vulnerability drops, especially when multiple of them land in rapid fire.”
-
RATs! Remote Management Software from the Hacker’s Perspective“Any day I get to dust off my Sliver team server and do cool hacker stuff is a good day.”
Thanks — we review every report.