Loading story…
ESET reported the emergence of RansomBoggs, a new ransomware strain used against targets in Ukraine. The malware was identified in attacks aimed at Ukrainian organizations, adding to the pattern of disruptive and destructive cyber activity affecting the country since Russia’s invasion.
The report indicates that RansomBoggs was deployed as part of real-world intrusions rather than being a proof-of-concept or commodity sample circulating broadly. Its appearance underscores the continued use of ransomware-style tooling in the Ukrainian threat landscape, where financially motivated techniques can overlap with operations intended to disrupt government, public-sector, or private-sector entities.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
ESET published research on a new ransomware family named RansomBoggs and stated that it was targeting organizations in Ukraine. No earlier specific event dates are provided in the reference content, so the publication date is used as the event date.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **RuRansom** is a destructive malware strain aimed at systems geolocated in Russia, presenting itself as ransomware while functioning primarily as a wiper. The malware checks a victim’s public IP address through external services and exits unless the host appears to be in Russia, then seeks elevated privileges, scans local, removable, and network drives, deletes `.bak` backup files, and encrypts files with **AES/AES-CBC** while appending the `.fs_invade` extension. It also drops a Russian-language note stating there is no decryption or payment path, underscoring that the operation is intended to damage Russian victims rather than extort them. Researchers said the malware is a **.NET 32-bit PE** sample that can spread in worm-like fashion across connected systems and USB devices, including by copying itself as `Россия-Украина_Война-Обновление.doc.exe`. Trend Micro linked RuRansom to the developer behind **dnWipe** and a downloader for **XMRig**, suggesting an actor experimenting with multiple destructive and financially motivated tools, while noting attribution remains unconfirmed. VMware and Cyble also described multiple variants that attempt privilege escalation and appear to have been developed during the Russia-Ukraine cyber conflict, with encrypted files considered effectively irreversible.
Aug 15, 2026
The pro-Ukrainian hacker group **Bearlyfy** has carried out more than 70 attacks against Russian companies, escalating from smaller intrusions and modest ransom demands into a broader campaign combining extortion with sabotage. Russian cybersecurity firm F6 said the group, active since January 2025 and also tracked as **Labubu**, initially relied on leaked ransomware code including **LockBit 3 Black**, **Babuk** for Linux, and a modified **PolyVice** variant before shifting in March to a custom Windows strain called **GenieLocker**. F6 said Bearlyfy typically gained access through exposed external services and vulnerable applications, then used tools such as **MeshAgent** for remote access and to support encryption or destructive activity. Researchers also reported cooperation with the pro-Ukrainian group **Head Mare** and tooling or infrastructure overlaps with **PhantomCore**, suggesting ties to a wider ecosystem targeting Russian and Belarusian organizations. The group’s ransom demands reportedly rose from about **€80,000** to several hundred thousand dollars, with roughly one in five victims paying, as Bearlyfy expanded from smaller businesses to larger Russian enterprises.
Jun 29, 2026
Ukraine faced another wave of disruptive ransomware as researchers identified **FakeCry**, a WannaCry-lookalike campaign that primarily hit Ukrainian victims and appeared to overlap with infrastructure previously associated with **M.E.Doc**-linked outbreaks such as **XData** and **NotPetya/Nyetya**. The malware was not a true WannaCry clone: it used a separate dropper, required specific command-line arguments, relied on a **Tor**-based command-and-control server, and terminated processes before encrypting files in use, suggesting a more tailored operation than a commodity copycat attack. A related regional campaign, **Bad Rabbit**, later struck organizations across Eastern Europe and Russia through compromised websites serving a fake Adobe Flash update, then spread internally using **SMB**, weak-credential brute forcing, mimikatz-like tooling, and the **EternalRomance** exploit associated with `MS17-010`. Cisco Talos reported that Bad Rabbit modified the **Master Boot Record**, used DiskCryptor-related components to encrypt disks and files, and shared a core codebase and similar build tooling with **Nyetya**, reinforcing concerns that multiple ransomware incidents in the region were closely connected in tradecraft even when presented as ordinary criminal extortion.
Aug 15, 2026