Loading malware…
0APT is a Rust-based ransomware family associated with a ransomware-as-a-service (RaaS) operation that surfaced in January 2026. Reporting consistently describes the broader operation as using a coordinated bluff campaign: the operators claimed more than 150-200 victims, but multiple investigations found no verifiable evidence of confirmed intrusions, operational encryption events, or credible exfiltrated data for the listed organizations. Researchers assessed the leak site and exposed RaaS panel were likely designed to project credibility and attract affiliates, and some reporting concluded the scheme may have been intended to defraud aspiring affiliates. Despite those doubts around victim claims, researchers confirmed that 0APT operated a functional affiliate platform and were able to generate ransomware samples directly from the onion-hosted portal.
The RaaS platform supported customized build generation for Windows, Linux, and macOS, with up to five samples per affiliate account in one report. Builds were customized per affiliate using unique build keys and affiliate identifiers while preserving a common core codebase. The platform also included extortion workflow features such as negotiation chat, payment tracking, admin support, and technical documentation. Generated ransomware appends the .0apt extension to encrypted files and drops a ransom note named README0apt.txt; reverse engineering of one analyzed sample observed ransom notes written as README0apt.txt.0apt per directory.
A specifically analyzed sample had SHA-256 3dc4593b14879cb0bb4dc19e85816f09ff6a5f4db8c2957331b557af1fa1a375 and was a 64-bit Rust 1.92.0 executable. On execution, it looks for Config2.txt in the current working directory and falls back to hardcoded defaults if the file is absent. Configuration supports exclusions for extensions, filenames, and folders; default exclusions included many system and operational file types such as .exe, .dll, .sys, .msi, .bat, .com, .vbs, and .0apt, and folders such as /windows, /ProgramData, /Program Files, /Program Files (x86), /temp, /tmp, /cache, /google/chrome, and /mozila/firefox. The default configuration also skips files larger than 1 GB, uses the number of CPU cores for parallel encryption threads, requires at least 500 MB of free RAM, checks memory availability every 100 ms, and includes a one-minute sleep timer.
For cryptography, the sample attempts to read public_key.pem from the current directory and falls back to an embedded 2048-bit RSA public key if missing. Before encryption it checks for allpath.txt; if present, only listed files are encrypted, otherwise it scans broadly for targets. The sample uses hybrid encryption with RSA and AES-256: for each file it generates a 32-byte AES key and 16-byte IV using OsRng, encrypts the AES key with RSA-OAEP, encrypts file contents with AES-256 via a stream-compatible mode, overwrites the file with a structure containing the RSA-encrypted AES key, IV, and ciphertext, flushes with File::sync_all, and renames the file with the .0apt extension. It also contains a hardcoded wallpaper image that it writes as embedded_wallpaper.png into %TEMP% and sets as the desktop wallpaper.
Researchers reported no observed persistence, propagation, or advanced evasion features in the analyzed sample, and assessed it appeared intended for targeted, manually controlled intrusions rather than autonomous spread. Hindi-language strings were observed in debug or execution logs; reporting noted this may suggest Indian linguistic influence but does not support definitive attribution. High-confidence indicators and artifacts mentioned in the reporting include the .0apt file extension, ransom note names README0apt.txt and README0apt.txt.0apt, Config2.txt, public_key.pem, allpath.txt, embedded_wallpaper.png, and the analyzed sample hash 3dc4593b14879cb0bb4dc19e85816f09ff6a5f4db8c2957331b557af1fa1a375.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Intel 471 discovered the alleged 0APT malware sample... technical analysis of the malicious file indicated it was more of a work in progress than a fully operational ransomware malware sample."
3 distinct techniques documented for this family, organized by ATT&CK tactic.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RaaS operation that provides functional cross-platform ransomware builders (Windows/Linux/macOS). Payloads append the .0apt extension and drop a ransom note (README0apt.txt) with unique victim identifiers. The operation’s leak site and claimed victim list appear largely fabricated, likely to defraud would-be affiliates, but the ransomware binaries themselves are described as functional and in circulation.
Rust-based ransomware operated via an active ransomware-as-a-service platform. It supports affiliate-specific builds, reads configuration from Config2.txt, can limit encryption scope via allpath.txt, uses a hybrid RSA+AES-256 encryption scheme, appends a .0apt extension to encrypted files, drops a ransom note, and sets a wallpaper image. The report notes no observed persistence, propagation, or advanced evasion features, suggesting use in targeted, manually controlled intrusions.
An alleged ransomware payload associated with the 0APT actor’s purported RaaS operation; reporting indicates the sample and supporting leak-site “proof” appear non-credible/fabricated and the malware may be incomplete or in development rather than an operational encryptor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.