DefrayX, also known by the alias Hive0091, emerged as a threat actor group in early 2017 with the development and deployment of the Defray ransomware. The group is financially motivated, setting them apart by initially deploying ransomware through highly customized spear-phishing campaigns that sometimes targeted only a handful of specific organizations. Over time, DefrayX has evolved its operations, becoming notably associated with RansomEXX ransomware, extending their attacks to both Windows and Linux operating systems since 2018.

Aliases del actor

Hive0091