RansomEXXMalware
- defray 2018
- defray-777
We recently discovered a new file-encrypting Trojan built as an ELF executable and intended to encrypt data on machines controlled by Linux-based operating systems. After the initial analysis we noticed similarities in the code of the Trojan, the text of the ransom notes and the general approach to extortion, which suggested that we had in fact encountered a Linux build of the previously known…From MISP Galaxy
Last reported 1 month ago, by Cisco Talos2 reports
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use“Other ransomware groups observed include NightSpire, NetRunner, LockBit 5.0, RansomEXX, Stormous, and AiLock.”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“IcedID was detected in attacks involving the following ransomware groups: Karakurt, RansomEXX, Black Basta, Nokoyawa, Quantum, REvil, Xingteam, and Conti.”
Indicators in its reports
named in the reports above- anbush[.]comin 1 report
- mysqlserver[.]orgin 1 report
- ipulsecloud[.]comin 1 report
- esoftwareupdates[.]comin 1 report
- cmdatabase[.]comin 1 report
- maximumservers[.]netin 1 report
- avdev[.]netin 1 report
- devcloudpro[.]comin 1 report
- uranustechsolution[.]comin 1 report
- qw.sveexec[.]comin 1 report
- situotech[.]comin 1 report
- 1ca4cbac895fc3bd12417b77fc6ed31din 1 report
- 194.165.16[.]64in 1 report
- 46.161.27[.]151in 1 report
- 193.142.30[.]37in 1 report
- 193.142.30[.]205in 1 report
- 81.19.135[.]229in 1 report
- 194.165.16[.]53in 1 report
- 5.188.87[.]47in 1 report
- 194.165.16[.]90in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.