Loading story…
The Satan ransomware operation, originally launched as a ransomware-as-a-service platform, evolved from affiliate-delivered file encryption into a network-spreading threat that abused multiple enterprise attack paths. Early versions let affiliates generate customized payloads, distribute them through droppers such as malicious Word macros or CHM installers, and encrypt files with extensions such as .stn while directing victims to Tor-based payment portals.
Later variants added worm-like and post-exploitation capabilities, including EternalBlue SMB exploitation, DoublePulsar-style propagation, and eventually Mimikatz credential dumping for lateral movement. Researchers reported infections beginning with a downloader such as sts.exe, which fetched password-protected archives containing the encryptor and propagation tools, dropped payloads such as C:\Cryptor.exe, killed database-related processes, and spread across vulnerable networks. The rebranded DBGer strain also incorporated exploitation of JBoss CVE-2017-12149, WebLogic CVE-2017-10271, and Tomcat brute forcing, appended .dbger-style encrypted filenames, and dropped _How_to_decrypt_files.txt ransom notes demanding up to 1 bitcoin.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
At the start of May 2018, researchers observed new Satan versions attempting lateral movement and infection through JBoss CVE-2017-12149, WebLogic CVE-2017-10271, and Tomcat brute forcing. These additions expanded Satan beyond SMB-based propagation.
A Satan downloader sample named sts.exe associated with the newer propagation-capable variant was compiled. The sample later retrieved password-protected archives containing the ransomware payload and EternalBlue propagation tooling.
Around November 2017, Satan developers updated the ransomware to spread across local networks using the EternalBlue SMB exploit. This marked a shift from basic affiliate-distributed ransomware toward self-propagating network infections.
A new ransomware-as-a-service platform named Satan was discovered, allowing affiliates to register, generate customized ransomware builds, and rely on the operator to handle ransom payments and feature development. Early Satan samples encrypted files with the .stn extension and dropped HELP_DECRYPT_FILES.html ransom notes.
Researchers reported that Satan’s operators had rebranded the malware as DBGer ransomware. Intezer linked DBGer to Satan through code similarity analysis, and the new variant used Mimikatz to dump credentials for lateral movement across networks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcebartblaze.blogspot.com
Open sourcebleepingcomputer.com
Open sourcealienvault.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Sodinokibi**, also known as **REvil** and **BlueCrab**, was distributed through multiple intrusion paths while its operators and affiliates steadily refined payload delivery and defense evasion. Researchers documented infections delivered via malspam, spear-phishing, compromised websites, exposed or stolen **RDP** access, and exploitation of vulnerabilities including `CVE-2019-2725`, `CVE-2018-13379`, and `CVE-2019-11510`. In South Korea, attackers also abused vulnerable WordPress sites for **SEO poisoning**, planting fake forum pages that pushed victims to download ZIP archives containing malicious JavaScript, which then fetched additional scripts, launched PowerShell, loaded a .NET injector in memory, and executed the ransomware through a Delphi-based loader. The operation paired technical sophistication with aggressive monetization. Analysts reported frequent changes to JavaScript obfuscation, command-and-control paths, PowerShell execution methods, process injection techniques, and target process names to reduce antivirus detection, alongside logic to disable security tooling and delete **Volume Shadow Copies** before encryption. IBM described the group’s use of **Curve25519**, **ECDH**, **Salsa20**, **AES**, and **SHA-3** in its encryption workflow, as well as its **double-extortion** model of stealing data and threatening publication on **The Happy Blog**. The ransomware was linked to a broad affiliate ecosystem, represented **22%** of IBM X-Force incident response engagements in 2020, and was reported to heavily impact organizations in the United States, United Kingdom, Australia, and Canada.
Aug 14, 2026
Ransomware operators behind **REvil/Sodinokibi** and **DoppelPaymer** increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed **RDP** and **VPN** services, phishing-delivered malware such as **QAKBOT**, **Emotet**, and **Dridex**, brute force, and exploitation of internet-facing systems, then expanding control with tools including **Mimikatz**, **BloodHound**, **PsExec**, **WMI**, **Cobalt Strike**, and **Empire**. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks. REvil also helped normalize **double extortion** by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in **Mega.nz**. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Aug 15, 2026
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026