Loading malware…
MegaCortex is an enterprise-focused Windows ransomware family first identified in 2019 and associated with targeted intrusions against organizations in Europe and North America. It has been linked in reporting and law-enforcement activity to criminal ransomware operations that also used tooling such as Cobalt Strike, and it has been observed in intrusion chains where initial access or staging was provided by other malware families including Emotet and QakBot. Operators have been described as gaining footholds through phishing, exploits, SQL injection, and stolen credentials, then moving laterally and escalating privileges before deploying the ransomware across selected networks.
MegaCortex evolved from a manually deployed, post-compromise ransomware into a more automated variant designed for broader operational use. Earlier deployments reportedly required an attacker-supplied password, while later versions embedded that password and could self-execute. The malware is known for aggressively terminating processes and services, including security-related software, to maximize encryption coverage. Technical reporting also describes use of Base64-decoded components, registry modification to store ransom contact information, privilege-dependent execution flow, and process injection behavior involving a helper DLL loaded into a newly created rundll32.exe process.
A later 2019 variant added coercive features beyond file encryption. Reported behaviors include changing the logged-in user’s Windows password, setting a pre-logon legal notice to display a lock message, removing shadow copies, wiping free space, and dropping ransom instructions. Its ransom messaging also threatened publication of stolen data if payment was not made, reflecting the broader shift toward double-extortion tactics, although confirmed file theft was not established in the technical analysis cited. MegaCortex is widely characterized as targeted ransomware used after substantial post-exploitation activity rather than as a purely opportunistic commodity threat.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
it is a targeted ransomware installed through network access provided by trojans such as Emotet. Once the MegaCortex actors gain access...
This tool allows the attackers to deploy "beacons" on a compromised device to "create shells, execute PowerShell scripts, perform privilege escalation, or spawn a new session to create a listener on the victim system."
it is a targeted ransomware installed through network access provided by trojans such as Emotet. Once the MegaCortex actors gain access...
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
a particular base64 encoded string would need to be provided in order for the ransomware to extract and inject a DLL into memory.
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
there are references to the Windows Cipher /W: command, which is used to overwrite deleted data so that it cannot be recovered using file recovery software.
it is a targeted ransomware installed through network access provided by trojans such as Emotet. Once the MegaCortex actors gain access...
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
The threat actors will also use a variety of LOLBins and legitimate software such as ... nslookup...
The threat actors will also use a variety of LOLBins and legitimate software such as ... massscan.exe.
The response can be a simple acknowledgment or a longer set of instructions, a module or executable... In many cases the C2 server response only contains an updated version of the binary... If the victim is infected with the latest version of Emotet... the latest modules are downloaded.
The criminals would then lay undetected in the compromised systems, sometimes for months, probing for more weaknesses in the IT networks before moving on to monetising the infection by deploying a ransomware. These cyber actors are known to have deployed LockerGoga, MegaCortex and Dharma ransomware, among others. | A ransom note was then presented to the victim, which demanded the victim pay the attackers in Bitcoin in exchange for decryption keys.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
63 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Sophisticated ransomware using both automated and manual attack components.
MegaCortex is a ransomware family that has been used in targeted attacks against enterprises, encrypting files and demanding ransom for decryption.
Ransomware that targets enterprises, encrypts data, and demands ransom, often used in conjunction with other ransomware families in coordinated attacks.
Ransomware strain used in attacks against hundreds of organizations across the U.S. and Europe, causing significant financial damage.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.