RansomEXX is a financially motivated ransomware group that debuted as Defray777 in 2018, gaining prominence in 2020 after rebranding to RansomEXX and engaging in high-profile attacks. The group operates a double extortion model, exfiltrating sensitive data before encrypting files and threatening public release if ransom demands are not met. RansomEXX distinguishes itself through its targeted, human-operated attacks on high-value organizations and its development of both Windows and Linux variants of its ransomware, a capability that expanded in mid-2020. More recently, the group has adopted the Rust programming language for new ransomware variants, which aids in evading traditional antivirus detection. RansomEXX is also known by the aliases Defray, Defray777, and Ransom X, and is linked to the threat group Gold Dupont.

Aliases del actor

Defray 2018Ransom XDefray777DefrayDefray-777

Actores similares

DefrayXapt · 0lockbit3ransomware · 2016qilinransomware · 1933akiraransomware · 1524playransomware · 1268clopransomware · 1254lockbit2ransomware · 1002ransomhubransomware · 842incransomransomware · 832alphvransomware · 731

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker