Loading story…
Researchers detailed Pandora ransomware as a Windows threat that encrypts files, appends the .Pandora extension, and drops a ransom note named Restore_My_Files.txt across affected directories. The malware was reported to create a mutex, generate victim-specific RSA keys, manually mount drives, and use multithreaded encryption to speed impact. Its ransom note claimed data theft and threatened public leaks through a Tor site, while one analysis identified the contact address as contact@pandoraxyz.xyz, indicating a likely double-extortion model combining encryption with data exfiltration pressure.
Technical analyses found Pandora heavily packed and obfuscated, using modified UPX sections, encrypted strings, indirect function calls, and control-flow tricks such as opaque predicates to frustrate reverse engineering. The malware also attempted to weaken defenses by patching EtwEventWrite and bypassing AmsiScanBuffer, while deleting shadow copies and emptying the recycle bin to hinder recovery. Multiple researchers said Pandora showed strong code and operational overlap with ROOK ransomware, suggesting it may be a rebrand, and Fortinet demonstrated that emulation with IDA Pro, IDAPython, and FLARE flare-emu could automatically resolve hidden calls and decrypt strings that would be impractical to analyze manually.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
On 2022-04-19, Fortinet published analysis showing how emulation in IDA Pro and flare-emu could be used to reverse Pandora's obfuscated function calls and decrypt strings automatically. The write-up identified artifacts including the mutex string "ThisIsMutexa" and ransom note name "Restore_My_Files.txt."
On 2022-03-21, an independent analyst published reverse-engineering notes on Pandora ransomware, covering its modified UPX packing, ETW and AMSI tampering, mutex use, shadow-copy deletion, and ransom note contents. The write-up also highlighted similarities with Rook ransomware.
On 2022-03-15, Cyble published a technical analysis of Pandora ransomware describing its encryption behavior, anti-analysis features, and similarities to ROOK. The report also documented the sample's ".Pandora" extension and ransom note "Restore_My_Files.txt."
Cyble says Pandora emerged publicly in early 2022 and came into the spotlight in March 2022 after naming several victims on its leak site. At the time of the report, around five victims had been posted.
Cyble reported that Pandora later posted the same victim that ROOK had claimed earlier, reinforcing suspicions of a rebrand or close operational overlap. The report places this reposting in March 2022.
Cyble states that Pandora ransomware announced its first victim on its leak site on 21 February 2022. This is presented as the first publicly observed victim disclosure for the group.
Cyble reported that ROOK ransomware's leak site went down around the end of January 2022. The disappearance preceded Pandora posting the same victim later in March 2022.
Cyble's report says ROOK ransomware claimed in December 2021 to have attacked one of the world's largest automotive suppliers of technology and components. This later became part of the evidence cited for similarities between ROOK and Pandora.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
cloudsek.com
Open sourcefortinet.com
Open sourcefortinet.com
Open sourcekienmanowar.wordpress.com
Open sourcedissectingmalwa.re
Open sourceblog.cyble.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Play ransomware** group, also tracked as **PlayCrypt** and attributed by Symantec to **Balloonfly**, has conducted double-extortion intrusions since 2022 while refining both its initial access and post-compromise tradecraft. Symantec reported the group exploited Microsoft Exchange flaws **`CVE-2022-41080`** and **`CVE-2022-41082`**, then used newly observed custom .NET utilities to accelerate victim profiling and data access before encryption. One tool, **Grixba**, surveys domain users, computers, software, services, security products, backup platforms, and remote administration tools, and can also clear logs on local and remote systems; another uses the **AlphaVSS** library to copy files from **Volume Shadow Copy Service** snapshots, including files normally locked by the operating system. Reverse-engineering of the Play encryptor shows a ransomware family built for enterprise attacks, using a hybrid **RSA-AES** scheme, heavy obfuscation, API hashing, and anti-analysis techniques. The malware has been linked with tools and access methods including **SystemBC RAT**, **Cobalt Strike**, **AdFind**, **WinPEAS**, **WinSCP**, **RDP**, and **SMB**, and it enumerates local and network drives, skips selected files and directories, encrypts files in size-based chunks, appends the **`.PLAY`** extension, and drops a **`ReadMe.txt`** ransom note. Researchers also noted a coding flaw that can cause files to be renamed even when encryption does not complete successfully, underscoring both the malware’s sophistication and its ongoing evolution.
Aug 15, 2026
The **Maze** ransomware operation evolved from earlier exploit-kit activity associated with “ChaCha ransomware” into a prominent double-extortion threat that stole data before encrypting systems and then pressured victims by publishing stolen files on dedicated leak sites. Operators built a public reputation around naming victims, courting media attention, and using data exposure as leverage to increase the likelihood of ransom payments. Maze infections were delivered through multiple channels, including spam campaigns impersonating government tax agencies and later more targeted compromises through **Remote Desktop Protocol (RDP)** access and network exploitation. Sophos reported that the malware used heavy obfuscation, anti-analysis checks, persistence mechanisms, system and network reconnaissance, **HTTP POST** data exfiltration, and file encryption based on **RSA** and **ChaCha20**, while also showing selective behavior such as adjusting demands for home versus corporate systems and easing pressure in some medical-sector cases during COVID-19.
Jun 29, 2026
The **Egregor** ransomware operation carried out double-extortion attacks by stealing sensitive data, encrypting victim systems, and threatening to publish stolen information on a leak site if victims refused to pay. Researchers linked Egregor to an ecosystem associated with **Sekhmet** and possible former **Maze** affiliates, with additional reported ties to **ProLock** and **LockBit**. Victims cited in reporting included **GEFCO**, **Barnes & Noble**, and **Ubisoft**, while the group’s leak site reportedly listed **152 victim companies** across industries including information technology, construction, retail, consumer goods, and automotive. Intrusions commonly began with **phishing** or **RDP exploitation**, after which attackers used **Cobalt Strike** for payload delivery and in some cases leveraged **QBot** and living-off-the-land tools such as `bitsadmin`. The malware used heavily obfuscated DLL payloads with **Salsa20**-encrypted configuration data, required a sample-specific launch key passed with the `-p` parameter, and encrypted files with **ChaCha** and **RSA-2048**. Researchers also observed the group using **Rclone** with attacker-supplied configuration data to exfiltrate stolen files, while the ransomware appeared to avoid encrypting systems configured with several CIS-region languages.
Jul 12, 2026