Malware

FunkSec

FunkSec is a Rust-based ransomware family and associated extortion operation that emerged in late 2024. It encrypts victim files using the orion-rs cryptographic library with ChaCha20 and Poly1305, changes the desktop wallpaper to present a ransom message, and has been associated with double-extortion activity. Observed variants attempted to impair recovery and endpoint defenses by deleting volume shadow copies and disabling Microsoft Defender through PowerShell and system-configuration changes. Multiple researchers assessed that its development was partially assisted by large language models; rapid naming changes and unusually structured code have been cited as supporting evidence. The operation claimed victims predominantly in the United States, India, and Brazil, with technology, government, and education among the most frequently affected sectors. It ceased adding victims to its leak site in March 2025 and is regarded as inactive. A free decryptor is available through the No More Ransom project.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

The most common family was FunkSec, a ransomware strain that multiple researchers have linked to LLM assistance... Unit 42 said attackers are increasingly turning to AI tools to generate this kind of delivery code.

Execution

1 technique

T1059.001PowerShellEvidence1

The variants share a common Rust codebase and use similar evasion techniques: Disabling Windows Defender through PowerShell and registry modifications

Persistence

1 technique

T1112Modify RegistryEvidence1

The variants share a common Rust codebase and use similar evasion techniques: Disabling Windows Defender through PowerShell and registry modifications

Stealth

1 technique

T1070.004File DeletionEvidence1

The variants share a common Rust codebase and use similar evasion techniques: Deleting volume shadow copies

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The variants share a common Rust codebase and use similar evasion techniques: Disabling Windows Defender through PowerShell and registry modifications

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence3

Affiliates are individuals or groups that collaborate with RaaS operators to perform actions such as initial penetration, network lateral movement, data exfiltration, and ransomware distribution.

T1491DefacementEvidence1

The variants share a common Rust codebase and use similar evasion techniques: Changing the desktop wallpaper to display a ransom note

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

21 SOURCESView more in app

security weekNews

Aug 26, 2026

AI Speeds Up Malware Development, Not Its Success Rate: Analysis - SecurityWeek

Ransomware family linked by multiple researchers to LLM-assisted development. Embedded project filenames showed rapid iteration through multiple names, which Unit 42 assessed as consistent with prompt-driven generation.

palo alto networks unit 42 blogNews

Aug 25, 2026

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

Ransomware strain with a common Rust codebase; observed disabling Windows Defender via PowerShell and registry changes, deleting volume shadow copies, and changing the desktop wallpaper to display a ransom note. The report suggests rapid variant iteration consistent with LLM-assisted development.

cloudatg insightsNews

Feb 13, 2026

AI Development & Software Engineering | CloudATG

Ransomware strain (emerged late 2024) for which a free public decryptor was released after the group went dormant (per summary).

cloudatg insightsNews

Feb 13, 2026

AI Development & Software Engineering | CloudATG

Ransomware family (late 2024) using double extortion (data theft + encryption) and described as AI-assisted.

+17 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

FunkSec