Skip to content
Threat Feed
Subscribe

Tag

Raas

4 briefs RSS
high threat

Sarcoma Ransomware Group Activity

The Sarcoma ransomware-as-a-service group continues to target mid-market organizations globally, recently exfiltrating 1.2 TB of data from a new victim in the United States.

Sarcoma ransomware extortion raas discovery exfiltration
3t 1i
critical threat

The Gentlemen Ransomware: Self-Propagating Go Encryptor

The Gentlemen ransomware, operated by Storm-2697 as a RaaS, employs a combination of strong per-file encryption with aggressive self-propagation to achieve broad network compromise, targeting Windows environments and using double extortion tactics.

Microsoft Defender Storm-2697 ransomware raas lateral-movement encryption
2r 4t
high threat

Ransomware-as-a-Service (RaaS) Ecosystem: Affiliate Tradecraft and Initial Access Vectors

Ransomware-as-a-service (RaaS) attacks leverage affiliates for initial access, persistence, and exfiltration, using varied techniques like compromised RDP, vulnerable VPNs, and rogue RMM tools, impacting multiple organizations in a single campaign.

Remote Desktop Protocol +7 ransomware raas initial-access persistence
2r 1t
high threat

VECT Ransomware Destroys Files Due to Encryption Flaw

VECT 2.0 ransomware, a RaaS offering, permanently destroys large files due to an encryption flaw, discarding decryption nonces for files above 128 KB, rendering them unrecoverable and effectively acting as a wiper; it uses raw ChaCha20-IETF with no authentication.

ESXi +3 TeamPCP ransomware wiper raas
2r 1t