MalwareUsed by 2 actors

MegaCortex

MegaCortex is a Windows enterprise-targeted ransomware family active from 2019 and associated with organized ransomware operations that also used LockerGoga and Nefilim. It encrypts victim files for extortion and has targeted organizations in Europe and North America across multiple industries. Early activity generally involved manual deployment after compromise of a corporate network; operators deployed it through Active Directory infrastructure or post-exploitation tooling after access was established, including access facilitated by malware such as Emotet. Later variants automated execution, anti-analysis measures, and the termination of security products and services, enabling broader deployment.

MegaCortex variants can remove shadow copies, wipe free space, terminate processes and services that could impede encryption, alter the logged-on Windows account password, and configure a pre-logon message to communicate the compromise when users can no longer sign in. The ransomware creates ransom instructions and has threatened public release of victim data, although data theft by the malware itself has not been conclusively established. It has also been observed using Windows process-manipulation APIs and loading a helper component into a newly created legitimate Windows process. Criminal operations associated with MegaCortex conducted network reconnaissance, lateral movement, and prolonged post-compromise access before ransomware deployment. Law-enforcement investigations have linked MegaCortex activity to large-scale attacks against corporations and critical infrastructure worldwide.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Volodymyr Tymoshchuk

The court found the unnamed Ukrainian man to be the lead developer of the LockerGoga, MegaCortex, and Nefilim ransomware families.

via bitdefender blogbitdefender.com

Oleksandr Ieremenko

Les attaques ont utilisé trois familles de ransomware : LockerGoga, MegaCortex, Nefilim.

via cyberveillecyberveille.ch

MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1078Valid AccountsEvidence4

La section « TTPs et IOCs détectés » associe explicitement T1078 — Valid Accounts aux attaques attribuées à Oleksandr Ieremenko.

T1190Exploit Public-Facing ApplicationEvidence2

La section « TTPs et IOCs détectés » associe explicitement T1190 — Exploit Public-Facing Application aux attaques attribuées à Oleksandr Ieremenko.

T1566PhishingEvidence2

Some of these criminals were dealing with the penetration effort, using multiple mechanisms to compromise IT networks, including brute force attacks, SQL injections, stolen credentials and phishing emails with malicious attachments.

Execution

2 techniques

T1059.003Windows Command ShellEvidence3

Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files.

T1106Native APIEvidence1

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Persistence

3 techniques

T1078Valid AccountsEvidence4

La section « TTPs et IOCs détectés » associe explicitement T1078 — Valid Accounts aux attaques attribuées à Oleksandr Ieremenko.

T1098Account ManipulationEvidence1

Further analysis of the code by Kremez confirmed that MegaCortex is indeed changing the password for the victim's Windows account. It does this by executing the net user command when the ransomware is executed.

T1112Modify RegistryEvidence1

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence2

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.

T1078Valid AccountsEvidence4

La section « TTPs et IOCs détectés » associe explicitement T1078 — Valid Accounts aux attaques attribuées à Oleksandr Ieremenko.

T1098Account ManipulationEvidence1

Stealth

5 techniques

T1055Process InjectionEvidence2

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.

T1078Valid AccountsEvidence4

La section « TTPs et IOCs détectés » associe explicitement T1078 — Valid Accounts aux attaques attribuées à Oleksandr Ieremenko.

T1140Deobfuscate/Decode Files or InformationEvidence1

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

T1218.011Rundll32Evidence1

These DLLs are not injected into any processes, but rather run via Rundll32.exe.

T1497Virtualization/Sandbox EvasionEvidence1

Other upgrades in version 2.0 include anti-analysis features within the main malware module

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

1 technique

T1110Brute ForceEvidence1

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence2

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1497Virtualization/Sandbox EvasionEvidence1

Other upgrades in version 2.0 include anti-analysis features within the main malware module

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Once the MegaCortex actors gain access, they then push the ransomware out to machines on the network via an active directory controller or post-exploitation kits.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

The response can be a simple acknowledgment or a longer set of instructions, a module or executable... In many cases the C2 server response only contains an updated version of the binary... If the victim is infected with the latest version of Emotet... the latest modules are downloaded.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

Stadler Rail : intrusion en 2020, exfiltration de données, chiffrement des systèmes

T1537Transfer Data to Cloud AccountEvidence1

...an unnamed cybercriminal group that hacked corporate networks, stole data and encrypted systems to extort victims.

Impact

5 techniques

T1486Data Encrypted for ImpactEvidence16

Le suspect est présenté comme le principal développeur des rançongiciels Lockergoga, Megacortex et Nefilim; Stadler Rail a été sommée de payer une rançon en bitcoin.

T1489Service StopEvidence1

TTPs et IOCs détectés # TTP # T1486 — Data Encrypted for Impact (Impact) T1489 — Service Stop (Impact)

T1490Inhibit System RecoveryEvidence1

These CMD files will execute a variety of commands that removes shadow volume copies...

T1565Data ManipulationEvidence1

Les charges retenues par le Ministère public incluent : ... Détérioration grave de données

T1657Financial TheftEvidence2

rançon de 6 millions de dollars en bitcoins exigée

Other

1 technique

T1562Impair DefensesEvidence1

Other upgrades in version 2.0 include anti-analysis features within the main malware module, and the functionality to stop and kill a wide range of security products and services automatically.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 years ago

email●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

73 SOURCESView more in app

bitdefender blogNews

Sep 24, 2026

Ukrainian ransomware developer jailed for nearly 13 years

Ransomware family allegedly developed by the convicted individual and used in worldwide corporate extortion attacks.

security weekNews

Sep 24, 2026

US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks - SecurityWeek

Ransomware family mentioned only in passing in relation to an unrelated Swiss criminal sentence.

zdnetNews

Sep 23, 2026

Cette enquête cyber française aboutit à une très lourde condamnat ...

Ransomware allegedly developed by the convicted suspect and identified as one of the ransomware families involved in attacks against organizations including Spie and Altran in January 2019.

cyberveilleNews

Sep 16, 2026

Suisse : un développeur ukrainien de ransomwares condamné à près de 13 ans de prison | CyberVeille

Ransomware family that the convicted developer was found to have developed; the article does not specify its technical functionality beyond ransomware activity.

+69 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

MegaCortex