Lilith is a ransomware-as-a-service (RaaS) operation that first emerged in July 2022, discovered by malware researcher JAMESWT. It operates with a clear financial motivation, employing a double extortion model. Despite being described by cybersecurity researchers as having low sophistication and not introducing novel techniques, Lilith distinguished itself by appearing alongside other new ransomware groups during a period of increased ransomware activity. The group is also known as LilithCrypt, and while it exhibits some similarities in code or methodology, such as excluding a Babuk ransomware public key file from encryption, it has not been directly linked as a rebrand of Babuk or other groups. Its initial victim was a large construction group in South America, indicating a focus on 'big-game hunting' from its inception.

Aliases del actor

LilithCrypt

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker