Prometheus Ransomware Spawned Thanos-Based Extortion Variants as a Free Decryptor Emerged

Prometheus emerged as a Thanos-based ransomware operation targeting organizations with file encryption, victim-specific extensions, and ransom notes such as RESTORE_FILES_INFO.txt and .hta variants, while also threatening to leak stolen data through a dedicated extortion site and negotiation portal. Researchers said the group claimed ties to REvil, but multiple analyses found no technical evidence to support that assertion, instead linking Prometheus to the leaked Thanos builder and a broader ransomware-as-a-service ecosystem. Reported demands ranged from $6,000 to $100,000 in Monero, and the malware was observed terminating backup and security processes, altering services, and disabling protections including Raccine to speed encryption and increase pressure on victims.

A free CyCraft decryptor later offered partial recovery for some Prometheus-encrypted files by brute-forcing the malware's weak tickcount-derived Salsa20 key generation, a flaw that made decryption feasible when known file structures or magic bytes were available. Its release was followed by the apparent shutdown of Prometheus infrastructure, but closely related Thanos-derived strains including Haron, Spook, and Midas continued to appear, reusing code, extortion tactics, leak sites, and technical markers such as shared note formats and encryption artifacts. Subsequent reporting tied these families to rebranding and builder reuse rather than a single clear attribution, showing how Prometheus became part of a wider lineage of ransomware operations targeting businesses across multiple sectors and countries.