Loading story…
MegaCortex ransomware was reworked from a manually deployed, enterprise-focused threat into a variant better suited for broader distribution, according to researchers. Accenture iDefense reported that MegaCortex v2 hard-coded the installation password into the binary and enabled self-execution, removing steps previously handled by an operator. The malware also added anti-analysis features and automated the stopping or killing of security products and services, raising concerns that it could be spread more widely through email campaigns or dropped as a secondary payload by other malware families. Earlier campaigns had already hit enterprises in Europe and North America, with reported ransom demands ranging from 2 to 600 Bitcoin.
A later MegaCortex variant became more aggressive after execution, encrypting files with the .m3g4c0rtx extension, dropping the ransom note !-!_README_!-!.rtf, and changing victims’ Windows account passwords. Researchers said MegaCortex was typically deployed after attackers gained network access through trojans such as Emotet, then moved through environments using Active Directory controllers or post-exploitation tools. The updated ransom note also threatened to publish stolen data if victims refused to pay, signaling an early shift toward double-extortion tactics, while the malware launcher was found signed with a Sectigo certificate issued to MURSA PTY LTD that was later revoked.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Sectigo told BleepingComputer it revoked the abused code-signing certificate issued to MURSA PTY LTD after it was used to sign the MegaCortex launcher sample. The revocation occurred at 4:20 PM ET on November 5, 2019.
Analysis of the newly discovered variant found it appends the .m3g4c0rtx extension, sets a pre-login legal notice, changes the victim's Windows account password with the net user command, and drops a ransom note threatening to publish stolen data. The report noted that actual data theft was not confirmed.
On November 5, 2019, MalwareHunterTeam discovered a new MegaCortex sample that Vitali Kremez reverse engineered. Analysis showed a 2019 variant with more aggressive behavior beyond encryption.
Accenture iDefense reported that a second MegaCortex variant removed the attacker-supplied installation password, hard-coded it in the binary, and enabled self-execution. The new version also automated disabling security products and added anti-analysis features, potentially allowing wider distribution by affiliates or third parties.
Before its later redesigns, MegaCortex was used in manual, post-network-exploitation campaigns against carefully selected enterprise targets in Europe and North America. Operators reportedly demanded between 2 and 600 Bitcoins from victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026
**MedusaLocker** has continued to evolve from its 2019 origins into a mature ransomware operation that targets enterprise networks through exposed or weakly secured **RDP**, stolen or brute-forced credentials, phishing, spam, and vulnerable VPN or edge devices. U.S. government reporting has described the threat as a **ransomware-as-a-service** model in which affiliates conduct intrusions and share proceeds with developers, while multiple technical profiles show the malware encrypting local disks, mapped drives, accessible **SMB** shares, and broader network resources after gaining a foothold. Later variants, including **MedusaLocker v3** or **BabyLockerKZ**, also steal data to support **double extortion** and focus on maximizing damage inside victim environments rather than relying on external command-and-control traffic. Across variants, MedusaLocker uses **AES-256** encryption with **RSA-2048** key protection, deletes shadow copies and backups to hinder recovery, and establishes persistence through scheduled tasks, roaming-profile executables, and registry-based mechanisms such as `HKCU\SOFTWARE\PAIDMEMES` or `HKEY_CURRENT_USER\SOFTWARE\MDSLK\Self`. Researchers and government agencies report additional behaviors including PowerShell execution, safe-mode reboots to impair defenses, UAC bypass, process termination to unlock files, ICMP network sweeping, CIDR-aware share discovery, hidden-volume mounting, and self-relaunch with a `-network` argument to widen encryption. The malware has used changing file extensions such as `.meduza216` and varying ransom note names including **How_to_back_files.html**, **HOW_TO_RECOVER_DATA**, and related templates, with victims reported across healthcare, finance, government, and manufacturing.
Aug 15, 2026
The **Egregor** ransomware operation carried out double-extortion attacks by stealing sensitive data, encrypting victim systems, and threatening to publish stolen information on a leak site if victims refused to pay. Researchers linked Egregor to an ecosystem associated with **Sekhmet** and possible former **Maze** affiliates, with additional reported ties to **ProLock** and **LockBit**. Victims cited in reporting included **GEFCO**, **Barnes & Noble**, and **Ubisoft**, while the group’s leak site reportedly listed **152 victim companies** across industries including information technology, construction, retail, consumer goods, and automotive. Intrusions commonly began with **phishing** or **RDP exploitation**, after which attackers used **Cobalt Strike** for payload delivery and in some cases leveraged **QBot** and living-off-the-land tools such as `bitsadmin`. The malware used heavily obfuscated DLL payloads with **Salsa20**-encrypted configuration data, required a sample-specific launch key passed with the `-p` parameter, and encrypted files with **ChaCha** and **RSA-2048**. Researchers also observed the group using **Rclone** with attacker-supplied configuration data to exfiltrate stolen files, while the ransomware appeared to avoid encrypting systems configured with several CIS-region languages.
Jul 12, 2026