MorpheusMalware
- hellcat
Ransomware. Identical samples (apart from note) operated by Morpheus and HellCat ransomware groups.From MISP Galaxy
Last reported 23 days ago, by ransomware.live5 reports
ATT&CK techniques
6 of 22 · each with the sentence it comes from- T1003.001LSASS Memory
“…ames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
- T1020Automated Exfiltration
“Automated Exfiltration (T1020)”
- T1021.002SMB/Windows Admin Shares
“Remote Services: SMB/Windows Admin Shares (T1021.002)”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1027.008Stripped Payloads
“Obfuscated Files or Information: Stripped Payloads (T1027.008)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
morpheus lists Superior Plating Technology CO“morpheus lists Superior Plating Technology CO”
-
July 2026 Ransomware Trend Report“Existing groups such as The Gentlemen, DragonForce, Nova, Gunra, Everest, krybit, LockBit (LockBit 5.0), Qilin, Chaos, ShinyHunters, Morpheus, INC Ransom, and Coinbase Cartel continued their activities, while new data-stealing and ransomware groups—including Gammax, SECTION9, Exf…”
-
Why the Open Secure AI Alliance Matters: Open Frontier Models, Open Deployment Flexibility“TrendAI™ and Nvidia have collaborated across Morpheus, NIM, and Nemotron; integrated our endpoint detection and response (EDR) on BlueField data processing units (DPUs); delivered security-by-design for AI factories through our Nvidia DSX Air integration; and built a long track r…”
-
Ransomware debris: an analysis of the RansomHub operation“Since late 2023, Europol, NCA, FBI, and other law enforcement entities have conducted a series of operations such as Operation Morpheus, Operation Endgame, Operation Magnus as well as Operation Cronos against LockBit in February 2024 and an unnamed operation against ALPHV (aka Bl…”
-
The beginning of the end: the story of Hunters International“This included the arrests of criminals and law enforcement operations such as the Operations Endgame, Morpheus and Magnus conducted against botnet and stealer infrastructure, resources commonly used by ransomware groups’ affiliates to gain initial access to organizations’ netw…”
Indicators in its reports
named in the reports above- operations[.]inin 1 report
- 45.8.228[.]240in 1 report
- huntersinternational[.]suin 1 report
- 45.135.233[.]154in 1 report
- lynxblog[.]netin 1 report
- incblog[.]suin 1 report
- huntersinternational[.]bondin 1 report
- huntersinternational[.]ltdin 1 report
- huntersinternational[.]topin 1 report
- huntersinternational[.]vipin 1 report
- 193.106.175[.]48in 1 report
- huntersinternational[.]orgin 1 report
- 185.185.68[.]40in 1 report
- 109.172.85[.]126in 1 report
- 185.185.69[.]129in 1 report
- 185.12.127[.]116in 1 report
- 158.160.141[.]169in 1 report
- 192.185.35[.]253in 1 report
- 185.244.181[.]173in 1 report
- huntersinternational[.]netin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.