Ako is a financially motivated ransomware-as-a-service (RaaS) variant that emerged in September 2019, sometimes referred to as AKO Doxware or Medusa Reborn, though its creators have stated it is distinct from MedusaLocker. It operates on a model where core developers maintain the malware, and affiliates conduct attacks, with ransom payments typically split between them (55-60% to affiliates, the rest to developers). The group is assessed to be based in Russia, leveraging Russian infrastructure for its operations. What distinguishes Ako/MedusaLocker is its strategy of avoiding the encryption of executable files to ensure the compromised system remains functional for ransom payment. It also employs a hybrid encryption scheme using AES-256 and RSA-2048, and often reboots infected machines into safe mode to bypass security defenses.

Aliases del actor

Ako DoxwareMedusaRebornMedusalockertaxoffteam46APT HACKINGTEAMFreakOutNecroKek SecurityEnemyBototros relacionados con tecnologías como VMware Workspace ONEAdobe ColdFusionWordPressPHP ScriptcaseIOTAndroidcybercriminalSkipper TurlaKopiluwakestá vinculado al grupo TurlaCarbanakCarbon SpiderG0008Odinaffotros

Actores similares

apt-desertfalconactor · 1apt-hackingteamactor · 1apt-stealthfalconactor · 1apt-stonedrillactor · 1SCATTERED SPIDERapt · 0INDRIK SPIDERapt · 0MALLARD SPIDERapt · 0MUMMY SPIDERapt · 0SMOKY SPIDERapt · 0SALTY SPIDERapt · 0

Paises afectados

URLs nuevas detectadas en IntelTracker