Loading threat actor…
Team XXX is a ransomware threat actor that emerged in June 2024 and is tracked among the wave of new ransomware groups that expanded the 2024–2025 ransomware ecosystem. It has been identified alongside other newly formed groups such as Warlock, Global, W.A., and Kawa4096. Reporting associates these newer actors with a reshaping of the ransomware-as-a-service landscape through the absorption of technology and personnel from defunct operations, indicating continuity with prior criminal ransomware infrastructure and tradecraft. Available high-confidence reporting supports classifying Team XXX as a financially motivated ransomware actor, but detailed public information about its internal structure, malware lineage, victimology, operational geography, and specific intrusion tradecraft remains limited. Team XXX has been publicly listed as a new ransomware variant/group and has appeared in victim-claim tracking, but the supplied facts do not provide corroborated detail on its preferred sectors, countries of origin, or distinctive tactics beyond participation in ransomware/extortion activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a new ransomware variant/gang emerging in 2024 and associated with victim claims posted in June 2024.
Emerging ransomware group cited as part of a wave of new RaaS actors absorbing resources from defunct operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.