keeling
Keeling is described as a ransomware-as-a-service (RaaS) operation with an affiliate model and revenue-sharing, operating in the broader trend of increasingly stealthy, business-driven extortion. Reported targeting includes financial institutions, healthcare, legal firms, and managed service providers (MSPs), with emphasis on higher-value victims and maximizing business impact and payout potential. Keeling affiliates are noted exploiting unpatched Fortinet vulnerabilities, particularly affecting smaller IT environments and MSP-managed networks. The activity described aligns with modern ransomware tradecraft: initial access via misconfigurations and trusted tools, social engineering (including Microsoft Teams-based IT-staff impersonation to induce installation of remote-control tools), and abuse of legitimate IT/admin utilities (e.g., PowerShell, Nmap, Advanced IP Scanner, RClone, Azure Copy, and backup software APIs). The briefing also characterizes contemporary ransomware operations (including groups like Keeling) as using longer dwell times, multi-stage reconnaissance, stealthy lateral movement, data theft/exfiltration as a core extortion lever, and multi-layer extortion (double/triple extortion), sometimes applying supply-chain pressure and timing attacks for maximum operational impact. No nation-state attribution, specific aliases, or named sub-groups for Keeling are provided in the source content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Keeling is a ransomware group whose affiliates exploit unpatched Fortinet vulnerabilities, especially in smaller IT environments and MSP-managed networks.
Keeling is a ransomware group known for targeting high-value environments such as financial institutions, healthcare, legal firms, and managed service providers. They employ strategic, business-driven extortion models, focusing on fewer but more lucrative victims, and utilize data theft and multi-layer extortion tactics.
Keeling is a ransomware group known for targeting high-value environments such as financial institutions, healthcare, legal firms, and managed service providers. They employ strategic, business-driven extortion models, focusing on fewer but more lucrative victims, and utilize data theft and multi-layer extortion tactics.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.