Loading threat actor…
TeslaCrypt was a ransomware operation active in the mid-2010s and widely known for encrypting victim files for ransom. It is notable for ultimately shutting down and releasing master decryption keys, enabling recovery for affected victims without payment. TeslaCrypt is also remembered in later ransomware reporting because one of its distinctive technical markers, DEADBEEF, was reused or referenced as a recognizable motif by other criminal operations. High-confidence information in the available material supports TeslaCrypt’s role as a ransomware gang and its release of decryption keys at the end of its operation, but does not provide sufficient corroborated detail here on its operators’ origin, victimology, or broader targeting patterns.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as historical comparison for the use of the term DEADBEEF.
Referenced as a ransomware operation that released master decryption keys upon shutdown.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.