Loading malware…
0apt_ransomware, commonly referred to in the provided reporting as 0APT, is a ransomware operation assessed by Cyderes Howler Cell to be an active ransomware-as-a-service (RaaS) platform with a working affiliate model. Although some researchers, including GuidePoint Security, assessed the group may have been a fake gang using other criminals’ stolen data, Cyderes reported that it accessed the group’s RaaS portal, collected malware samples, and determined the ransomware payloads were viable, functional, and ready for deployment. The ransomware was described as a legitimate encrypter emphasizing reliability, operator configurability, and secure cryptographic implementation, with characteristics aligning with broader Rust-based ransomware trends. No specific infection vector, victimology, targeted industries, platforms, or indicators of compromise were provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cyderes has managed to get its hands on the group's actual ransomware, and it's apparently a legit encrypter.
1 distinct technique documented for this family, organized by ATT&CK tactic.
"The platform allowed affiliates to generate five ransomware samples per account... These samples utilized encryption algorithms including AES256, Salsa20/ChaCha, and the rare Speck cipher... Generated ransomware appends the .0apt extension and drops README0apt.txt"
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RaaS ransomware payload described as reliable and configurable, with secure cryptographic implementation and aligned with modern Rust-based ransomware development trends.
Ransomware referenced as a functional file-encrypting payload ('legit encrypter') after prior claims of fake victim listings.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.