Loading story…
SMAUG is a ransomware-as-a-service (RaaS) operation that advertises 64-bit payloads for Windows, Linux, and macOS, positioning itself as a multi-platform option for affiliates. The service reportedly charges a 20% affiliate fee plus a 0.2 BTC registration fee, and provides a web-based campaign builder, customizable ransom demands, offline encryption, and a "Company Mode" that allows a single decryption key to unlock multiple systems inside one targeted organization. Victims are directed to a Tor-based payment portal, while operators reportedly offer automated support for both affiliates and victims and bar attacks against CIS countries.
On Windows, SMAUG uses obfuscated Go binaries that gather system details and stored browser credentials, establish persistence through Registry Run Keys consistent with MITRE ATT&CK T1547.001, and then encrypt files for impact using AES-256 with keys protected by RSA-2048, aligning with T1486 Data Encrypted for Impact tradecraft. The combination of credential collection, registry-based autostart, and hybrid cryptography reflects a mature ransomware model designed to support repeatable intrusions and broad enterprise targeting across multiple operating systems.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelLabs reported that the SMAUG ransomware-as-a-service offering emerged toward the end of April 2020 as a fully public RaaS operation rather than an exclusive affiliate-only program.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified **Vect** as a new ransomware-as-a-service operation advertising a purportedly custom-built C++ locker for **Windows, Linux, and VMware ESXi**. The group began recruiting affiliates on a Russian-language cybercrime forum and promotes features including **ChaCha20-Poly1305** encryption, intermittent encryption for faster impact, Safe Mode execution, SMB and WinRM propagation, GPO-based deployment, and built-in packing or crypter functionality. Vect also operates **TOR-only** infrastructure for affiliate onboarding, victim communications, and leak-site publishing, and appears to follow a **double-extortion** model. The group has publicly claimed two victims in **Brazil** and **South Africa**, although neither the intrusions nor the full malware capabilities have been independently verified. Researchers said Vect shows unusually strong operational maturity for a newly observed crew, citing Monero payments, TOX communications, and a revenue-sharing model that waives entry fees for CIS-based affiliates while charging non-CIS applicants. Reporting suggests the operators may be experienced ransomware actors or a rebrand, and defenders were urged to harden exposed **RDP/VPN** and edge appliances such as Fortinet interfaces, segment management networks, watch for Safe Mode abuse and intermittent encryption, and strengthen anti-ransomware controls.
Jul 2, 2026
GandCrab grew into one of the most prominent **ransomware-as-a-service (RaaS)** operations by pairing frequent malware updates with a broad affiliate program, exploit-kit distribution, and supporting criminal services such as crypters. Technical analyses found the malware used anti-analysis and anti-recovery features, selective language checks to avoid CIS targets, privilege-escalation exploits in later `5.x` builds, and even a downloader that attempted persistence, Windows Defender and firewall bypasses, removable-drive propagation, and delivery of fresh payloads from hard-coded URLs. Researchers also documented repeated coding mistakes that enabled multiple public vaccines and decryptors, while defenders and projects such as **No More Ransom** helped victims recover files without paying in some cases. The operation also fought an extended defensive battle with South Korean vendor **AhnLab**, repeatedly changing tactics to evade or disable `V3 Lite`, including uninstall automation, service termination, and code injection into `Autoup.exe`, while AhnLab and other vendors countered with kill switches, patches, and blocking methods. GandCrab’s operators announced they were shutting down after claiming enormous profits, but reporting and later law-enforcement action indicated the ecosystem did not simply disappear: a Belarusian affiliate was arrested for allegedly infecting more than 1,000 systems across nearly 100 countries, and researchers noted likely continuity between GandCrab personnel or code and later ransomware activity including **REvil/Sodinokibi**.
Aug 15, 2026
**MedusaLocker** has continued to evolve from its 2019 origins into a mature ransomware operation that targets enterprise networks through exposed or weakly secured **RDP**, stolen or brute-forced credentials, phishing, spam, and vulnerable VPN or edge devices. U.S. government reporting has described the threat as a **ransomware-as-a-service** model in which affiliates conduct intrusions and share proceeds with developers, while multiple technical profiles show the malware encrypting local disks, mapped drives, accessible **SMB** shares, and broader network resources after gaining a foothold. Later variants, including **MedusaLocker v3** or **BabyLockerKZ**, also steal data to support **double extortion** and focus on maximizing damage inside victim environments rather than relying on external command-and-control traffic. Across variants, MedusaLocker uses **AES-256** encryption with **RSA-2048** key protection, deletes shadow copies and backups to hinder recovery, and establishes persistence through scheduled tasks, roaming-profile executables, and registry-based mechanisms such as `HKCU\SOFTWARE\PAIDMEMES` or `HKEY_CURRENT_USER\SOFTWARE\MDSLK\Self`. Researchers and government agencies report additional behaviors including PowerShell execution, safe-mode reboots to impair defenses, UAC bypass, process termination to unlock files, ICMP network sweeping, CIDR-aware share discovery, hidden-volume mounting, and self-relaunch with a `-network` argument to widen encryption. The malware has used changing file extensions such as `.meduza216` and varying ransom note names including **How_to_back_files.html**, **HOW_TO_RECOVER_DATA**, and related templates, with victims reported across healthcare, finance, government, and manufacturing.
Aug 15, 2026