Loading story…
A newly identified Erebus ransomware sample was found using a Windows User Account Control bypass to gain elevated execution without prompting the victim. The malware abuses eventvwr.exe by hijacking the .msc file association in the registry, a technique publicly documented as a fileless UAC bypass, then proceeds to collect the victim's IP address and country information, download a Tor client, and connect to an onion-based payment and command infrastructure.
Once active, Erebus encrypts a wide range of document and image files with AES, renames affected files using ROT-23, and deletes Windows Volume Shadow Copies to make recovery harder. It drops README.html ransom notes on the Desktop and in Documents, displays an on-screen message, and demands 0.085 BTC—about $90—within 96 hours; at the time of reporting, no free decryption option was available for victims of this sample.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Analysis of the sample showed it hijacked the .msc file association in the registry and launched via eventvwr.exe to execute with elevated privileges without a UAC prompt. The ransomware then encrypted files with AES, deleted Volume Shadow Copies, dropped README.html ransom notes, and demanded 0.085 bitcoins with a 96-hour deadline.
MalwareHunterTeam discovered a potentially new ransomware sample named Erebus on VirusTotal. Analysis indicated it was likely a rewrite or a different ransomware family reusing the Erebus name from an earlier 2016 report.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **CryptoHost**, also tracked as **Manamecrypt**, as a ransomware family that did not truly encrypt files but instead moved targeted data into a password-protected **RAR** archive and demanded **0.33 Bitcoin** for recovery. The malware reportedly stored both the archive and its executable under `AppData\Roaming`, established persistence through a **Run** registry key, and verified exact ransom payments through **blockchain.info** before releasing files. It was also reported as being bundled with a **uTorrent** installer and detected by security products as **`Ransom:MSIL/Manamecrypt.A`** and **`Ransom_CRYPTOHOST.A`**. Analysis of the malware showed the archive password was generated predictably from the archive name and the victim username, allowing affected files to be recovered without paying the ransom. Researchers also said the threat attempted to frustrate remediation by deleting the **SafeBoot** registry key and terminating processes associated with security tools, administration, gaming, shopping, and social-media applications. While some reports described the attacks as highly disruptive for users and companies, they also warned that ransom payment via **Bitcoin** remained risky and offered no guarantee of successful recovery, reinforcing the need for preventive security controls and backups.
Aug 15, 2026
**AnteFrigus** is a low-prevalence crypto-ransomware family that encrypts victim files with **AES**, appends random file extensions, and drops a ransom note as a randomly named `-readme.txt` file. The malware has primarily targeted English-speaking users but can affect victims globally, and observed samples avoided encrypting the `C:` drive while locking files on removable media and mapped network drives such as `D:` through `I:`. Victims were directed to pay through a **Tor** portal or contact `antefrigus@cock.li`, with ransom demands starting at **$1,995** and rising to **$3,990** after four days. Researchers linked AnteFrigus to the **Prometey** ransomware line and reported distribution through the **HookAds** malvertising campaign redirecting users to the **RIG exploit kit**, alongside possible delivery via exposed **RDP**, spam, malicious attachments, fake updates, botnets, and repacked installers. The malware reportedly used **iplogger.org** to identify the infected host’s IP address and skipped encrypting selected executable and system-related file types. Later variants adopted extensions including `.eaaeee`, `.bbadc`, `.aceadf`, `.daaefc`, and `.feeef`, and shifted to new ransom note names and payment sites such as `recovery-help.top` and `restore-now.top`.
Aug 15, 2026
Egregor emerged as a ransomware-as-a-service operation tied to the **Sekhmet/Maze** lineage and rapidly targeted organizations worldwide, including at least **69 victims** observed by France’s ANSSI, with some ransom demands exceeding **$4 million**. The group encrypted files with randomized extensions, dropped the ransom note `RECOVER-FILES.txt`, and threatened to publish stolen data within three days if victims did not negotiate through Tor-based payment and chat portals. Researchers linked Egregor to former Maze affiliates based on code overlap, shared infrastructure, similar ransom notes, and the migration of operators after Maze’s shutdown. Intrusions commonly began with phishing or illicit **RDP** access and frequently involved **Qakbot**, **IcedID**, **Ursnif**, **Cobalt Strike**, **AdFind**, **SharpHound**, **PsExec**, and **RClone** for reconnaissance, lateral movement, and exfiltration before encryption. Technical analyses described obfuscated DLL payloads, process injection, defense evasion, shadow-copy deletion, and file encryption using **ChaCha** with **RSA-2048**, while the malware avoided systems configured for several CIS-region languages. Egregor was linked to attacks on organizations including **GEFCO, Barnes & Noble, and Ubisoft**, and operated a public leak site—described by some researchers as a **“Hall of Shame”**—to pressure non-paying victims.
Aug 15, 2026