Rook is a ransomware group that emerged in late November 2021, distinguishing itself by its operational model largely derived from the leaked Babuk ransomware source code. The group primarily pursues financial gain through a dual-extortion scheme, encrypting victim files and exfiltrating sensitive data to pressure payment. Its unique initial self-introduction on its leak site expressed a desperate need for money. The group gained attention quickly, with its first victim, a Kazakh financial institution, identified just days after its initial appearance. Rook's activity was notable for its rapid adoption of leaked code and its multi-threading engine for efficient encryption. There is evidence to suggest that the group may have rebranded as Pandora in early 2022 due to significant tactical similarities, but this is a suspected connection rather than a confirmed alias.

Aliases del actor

APT HACKINGTEAM

Actores similares

apt-hackingteamactor · 1apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2apt-c-12actor · 1apt-18actor · 1apt-1877teamactor · 1apt-27actor · 1apt-30actor · 1apt-38actor · 1

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker