Loading story…
IceFire ransomware has expanded beyond Windows and is now targeting Linux enterprise environments, with SentinelLABS observing attacks against media and entertainment organizations worldwide. The intrusions exploited CVE-2022-47986, a deserialization flaw in IBM Aspera Faspex, to deploy a previously unreported Linux encryptor onto vulnerable CentOS-based file servers.
The Linux payload encrypts files and appends the .ifire extension, then drops ransom notes across affected directories and directs victims to a Tor-based payment portal linked to earlier IceFire operations. Researchers said the sample was undetected on VirusTotal at the time of reporting and traced hosting for the malware to a DigitalOcean droplet at 159.65.217.216, underscoring a broader shift by ransomware groups toward Linux server encryption through direct vulnerability exploitation rather than phishing.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelLABS reported that the IceFire ransomware group expanded from Windows-only operations to a Linux encryptor used against media and entertainment organizations worldwide. The intrusions leveraged CVE-2022-47986 in IBM Aspera Faspex to deploy the payload onto vulnerable CentOS-based file servers, with encrypted files receiving the ".ifire" extension and ransom notes dropped in affected directories.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a Linux-targeting variant of **RansomEXX**, marking an expansion of the ransomware family beyond its previously known Windows builds. The malware is a 64-bit ELF executable that encrypts files with **AES-256 in ECB mode** and appends an **RSA-4096**-encrypted AES key to each file, using cryptographic functions from the `mbedtls` library. Analysis found the Linux sample shares code structure, encryption logic, and ransom note language with earlier Windows PE versions, indicating it is a Linux build of the same ransomware family. The sample appears to have been used in highly targeted intrusions rather than broad campaigns. Researchers found hardcoded victim-specific identifiers embedded in the binary, including the encrypted file extension and extortion contact details, and noted a likely connection to a ransomware attack on a Brazilian government institution because of a nearly identical ransom note. Unlike many mature ransomware strains, the Linux variant lacked common supporting capabilities such as command-and-control communication, process killing, and anti-analysis features, suggesting operators relied on manual targeting and deployment.
Aug 15, 2026
Researchers detailed **DarkRadiation**, a Bash-based Linux ransomware family that targets **Red Hat, CentOS, and some Debian-based distributions** and spreads through an associated SSH worm. The worm accepts **base64-encoded credentials**, tests password or key-based SSH access, and, after a successful login, downloads and executes the ransomware on the victim host. The operation also uses the **Telegram API** alongside a command-and-control server to coordinate activity and report infection status. Once deployed, DarkRadiation installs prerequisites with **YUM** on CentOS and RHEL systems, encrypts files with **OpenSSL AES-CBC**, and appends a radioactive-symbol extension to affected files. Researchers found the malware can also **overwrite user passwords, delete users, create an attacker-controlled account named `ferrum`, disable shells, stop Docker containers, and drop a ransom note**, indicating an effort to both extort victims and disrupt Linux server operations. The analyzed scripts appeared to still be under development, while detection rates remained low at the time of reporting.
Aug 14, 2026
Researchers and incident responders reported that **Akira ransomware** affiliates used a repeatable intrusion playbook built around stolen VPN credentials and exploitation of internet-facing appliances, including Fortinet flaws `CVE-2019-6693` and `CVE-2022-40684` and Cisco ASA/FTD flaw `CVE-2023-20269`. Recovered attacker infrastructure exposed direct evidence of reconnaissance, credential theft, and exfiltration activity, including decrypted Fortinet configurations, password-protected RAR archives containing stolen victim data, and command history showing downloads from a public-facing victim server. Investigators said the operators relied heavily on legitimate administration tools such as AnyDesk, TeamViewer, OpenSSH, MobaXterm, PowerShell, WMI, Impacket, WinSCP, FileZilla, and Cloudflared, while moving laterally through RDP and SMB and attempting to disable defenses, erase evidence, and destroy Veeam backups before encryption. Analysis of Akira’s malware and victim activity showed a **double-extortion** model that spans both Windows and Linux environments. The Linux variant supports selective path targeting, network-share encryption, partial encryption, file exclusions, and multithreaded execution using AES and RSA, dropping `akira_readme.txt` ransom notes with Tor-based contact details. Reporting also tied Akira to broad U.S.-focused targeting across sectors and suggested some operators may overlap with other ransomware-as-a-service programs, including possible links to Snatch. The group’s activity continued to affect organizations such as Texas-based **CF Supply**, where attackers were reported to have compromised corporate data that could include client project records, personal information, contracts, and agreements.
Aug 14, 2026