Loading story…
Kaspersky reported the return of GpCode-like ransomware, reviving a file-encrypting extortion model associated with one of the early ransomware families. The malware locks victim data and demands payment for recovery, signaling that older criminal techniques continue to reappear in updated campaigns rather than disappearing from the threat landscape.
The report indicates that defenders should expect renewed use of classic ransomware tradecraft built around encryption, user coercion, and operational disruption. The resurfacing of a GpCode-like strain highlights the continued risk posed by recycled malware concepts that can be adapted for modern environments, particularly where organizations lack resilient backups, endpoint protections, and rapid containment procedures.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
A Securelist blog post stated that GpCode-like ransomware had reappeared, marking the observed return of this ransomware behavior or family. No additional incident dates or discrete prior events are provided in the reference.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **GPcode** (also known as **PGPCoder** and **GpCode**) evolved into a more serious ransomware threat by using working **`RSA-1024`** encryption that made large-scale brute-force recovery impractical. Reporting tied the operation to suspected Russian actors who used Yahoo email accounts, **E-Gold** and **Liberty Reserve** payment channels, and communications that appeared to originate from Chinese IP addresses. Analysts said the malware’s extortion model relied on victim-specific public keys and custom decryptors, making backups and file recovery more realistic response options than attempting to crack the encryption or paying the ransom. Reverse-engineering of a later GPcode sample showed the malware loading an encrypted **`cfg`** resource, creating the **`ilold`** mutex, enumerating logical drives, and encrypting files with selected extensions before appending the **`.ENCODED`** suffix. The sample used Windows CryptoAPI functions including **`CryptEncrypt`**, dropped **`HOW TO DECRYPT FILES.txt`** on the desktop, changed the wallpaper with a bitmap resource, demanded **$120** by wire transfer, and directed victims to contact **`datafinder@fastmail.fm`**. The malware also skipped some files, avoided encrypting files smaller than 11 bytes, destroyed crypto material after processing, and ran **`ntfs_system.bat`** to delete itself from the infected system.
Aug 15, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026
A new ransomware group known as **Gentlemen** has launched a series of attacks targeting organizations in at least 17 countries, employing a double extortion model that involves both data exfiltration and encryption. The ransomware, developed in the Go programming language, leverages advanced techniques such as Group Policy Object (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD) tactics to disable security defenses and propagate laterally within corporate networks. Industries affected include healthcare, manufacturing, and insurance, with the group specifically focusing on medium to large enterprises. The malware requires a specific `--password` argument to execute, serving as an anti-analysis measure, and offers operators various command-line options to control its behavior and evade detection. Analysts have identified Gentlemen as one of the most active emerging ransomware threats of 2025, with rapid expansion across North America, South America, and the Middle East. The group’s sophisticated evasion and propagation methods, combined with its aggressive targeting of sensitive data, underscore the urgent need for enhanced monitoring and defensive measures in enterprise environments. The campaign’s use of double extortion ensures that even organizations with robust backup strategies remain vulnerable to data leaks and reputational damage if ransoms are not paid.
Jun 29, 2026