Loading story…
AnteFrigus is a low-prevalence crypto-ransomware family that encrypts victim files with AES, appends random file extensions, and drops a ransom note as a randomly named -readme.txt file. The malware has primarily targeted English-speaking users but can affect victims globally, and observed samples avoided encrypting the C: drive while locking files on removable media and mapped network drives such as D: through I:. Victims were directed to pay through a Tor portal or contact antefrigus@cock.li, with ransom demands starting at $1,995 and rising to $3,990 after four days.
Researchers linked AnteFrigus to the Prometey ransomware line and reported distribution through the HookAds malvertising campaign redirecting users to the RIG exploit kit, alongside possible delivery via exposed RDP, spam, malicious attachments, fake updates, botnets, and repacked installers. The malware reportedly used iplogger.org to identify the infected host’s IP address and skipped encrypting selected executable and system-related file types. Later variants adopted extensions including .eaaeee, .bbadc, .aceadf, .daaefc, and .feeef, and shifted to new ransom note names and payment sites such as recovery-help.top and restore-now.top.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
An update dated 10 February 2020 described later AnteFrigus variants using extensions including .eaaeee and .bbadc, with ransom notes named CLICK_HERE-eaaeee.txt and CLICK_HERE-bbadc.txt. The synopsis also notes additional early-2020 variants using extensions such as .aceadf, .daaefc, and .feeef and new payment portals.
The reference states that AnteFrigus ransomware activity was observed in early November 2019. The malware encrypted files with AES, appended random extensions, and dropped ransom notes directing victims to a Tor payment site or antefrigus@cock.li.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet reported the emergence of **VanHelsing**, a Windows-focused ransomware family that encrypts victim files, appends extensions including `.vanlocker` and `.vanhelsing`, drops a `README.txt` ransom note, and changes the victim’s desktop wallpaper. The malware directs victims to **TOR-based negotiation portals** and a dedicated **data leak site**, and Fortinet identified at least two related samples that share the same extortion infrastructure despite using different encrypted-file extensions. The leak site listed multiple victims across the **United States, Italy, France, and Australia**, with **manufacturing** appearing most affected, although one identified victim was a **U.S. municipal government organization**, indicating the operators may not limit attacks by sector. The activity reflects a double-extortion model in which data theft and public shaming accompany file encryption, while U.S. Treasury guidance continues to warn that ransomware incidents can carry **sanctions compliance risks** when payments involve blocked persons or jurisdictions.
Aug 15, 2026
**CryptoLocker** emerged as a highly disruptive ransomware operation that encrypted files with strong public-key cryptography, including data on local drives, removable media, and accessible network shares, then demanded roughly **$300/€300** in **Bitcoin** or MoneyPak for the private key. Victims were warned they had only about **72 hours** to pay before losing access permanently, and reports indicated that the malware’s encryption was generally not breakable, leaving organizations and consumers dependent on payment or unaffected backups. Security reporting also noted that some victims who paid did receive working decryption keys, while disruptions to command-and-control infrastructure sometimes prevented even paying victims from recovering files. The operators later added a **"second chance"** decryption portal that raised the price from **2 bitcoins** during the initial deadline to **10 bitcoins** after expiration, effectively turning the campaign into a more structured extortion service. Coverage linked the operation to the use of **Tor** and resilient backend infrastructure to conceal command systems and maintain contact with victims, while later reporting traced **millions of dollars in laundered Bitcoin** tied to the crimewave. The campaign underscored how ransomware actors were combining strong encryption, anonymous payment channels, and hidden services to industrialize file-encryption extortion at scale.
Jun 29, 2026
Researchers identified **FuxSocy Encryptor** as a ransomware family that closely imitates the defunct **Cerber** strain in both presentation and parts of its internal logic. The malware encrypts victim files with **AES**, scrambles or renames filenames in Cerber-like patterns, drops ransom notes such as `***__READ___THIS__***.txt`, and can change the desktop wallpaper after locking data. Analysis found it skips or prioritizes certain folders, includes anti-virtual-machine checks, and in some variants partially encrypts files beginning at offset `0x708`, a technique that still leaves many documents unusable. The operators initially directed victims to make contact through **qTox/ToxChat** rather than a Tor payment portal, later shifting some variants to email addresses including `king-size_banana@thesecure.biz` and `fuxsocy@cockl.li`. Reporting on later samples shows the family remained active in subsequent years with variants using extensions such as `.b58d`, while likely relying on common intrusion routes including exposed **RDP**, phishing emails, malicious attachments, fake downloads, exploits, malvertising, and trojanized installers. No free decryptor was available in the early reporting, and victims were advised to recover from backups instead of paying the ransom.
Aug 15, 2026