M3rx is a financially motivated ransomware group first observed in 2025 that operates a Windows encryptor and a data leak site as part of its double extortion scheme. The group distinguishes itself through the use of a PE32+ x64 Go sample encryptor that leverages X25519 key exchange, AES-CTR for file content, and AES-GCM to wrap per-file AES keys, ultimately renaming encrypted files with a .8hmlsewu extension and performing self-deletion via PowerShell. M3rx operates under the aliases M3RX and M3RXDLS.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker