Loading malware…
Weyhro is a ransomware group/malware name referenced in Dragos reporting on industrial ransomware activity in 2025. In the provided content, Weyhro appears only as a low-volume or minimal-activity group: one mention states it registered one incident, and another places it among groups that each documented two incidents. No additional high-confidence technical details are provided in the source material regarding its malware family behavior, encryption methods, infection vectors, tooling, victimology, associated threat actors, targeted industries, or indicators of compromise. Based on the available content, the only supported characterization is that Weyhro was observed as a minor ransomware actor in 2025 reporting on incidents affecting industrial organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Minimal-activity ransomware brand referenced as part of the long-tail of operators.
Ransomware operation referenced as low-volume persistent activity in Q2 2025 (no additional detail provided).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.