TellYouThePass

TellYouThePass is a ransomware family active since at least 2019. It has been observed in multiple intrusion campaigns exploiting internet-facing remote code execution vulnerabilities, including Apache ActiveMQ CVE-2023-46604 and PHP for Windows CVE-2024-4577, to gain execution on exposed servers and deploy ransomware payloads. A .NET variant has been documented in exploitation chains targeting vulnerable Windows-based PHP deployments, including default-style XAMPP environments where PHP CGI exposure enables remote compromise.

The malware is associated with financially motivated ransomware activity and has been linked to a threat cluster commonly referred to as the TellYouThePass ransomware gang. Observed operations indicate opportunistic targeting of publicly reachable infrastructure rather than a narrowly defined vertical, with emphasis on vulnerable enterprise servers. In campaigns exploiting PHP for Windows, attackers used crafted requests to trigger native Windows utilities and execute staged script content that decoded and loaded the ransomware into memory.

TellYouThePass’s primary objective is file encryption for extortion. Its known role in observed campaigns is as the final ransomware payload delivered after successful exploitation of exposed services. Reporting also places it among several malware families historically deployed through exploitation of Apache ActiveMQ, showing that it is part of a broader ecosystem of post-exploitation monetization following server compromise.