Loading story…
The Paradise ransomware operation, a long-running ransomware-as-a-service family first seen in 2017, drew renewed concern after the source code for its .NET variant was leaked on the Russian-speaking XSS forum. Researchers said the leak included the Paradise builder and a decryption utility, and analysts verified the files as authentic. Although the .NET branch had seen more limited use than the native Paradise version, newly built samples were reportedly being classified as undecryptable, raising the risk that additional threat actors could repurpose the code against home users and small businesses.
Subsequent intrusions showed Paradise being deployed through suspected exploitation of outdated AweSun remote-control software, alongside activity involving Sunlogin flaws, Sliver C2, Cobalt Strike, BYOVD tooling, and XMRig. In one analyzed case, the ransomware used RSA-1024 encryption, deleted Volume Shadow Copies, set persistence through a Windows Run key, prioritized database and backup paths for encryption, and sent victim metadata to a command-and-control endpoint before dropping a ransom note tied to the email main@paradisenewgenshinimpact.top and a Bitcoin wallet. Defenders were urged to patch exposed remote-access software and maintain endpoint protections to reduce the risk of Paradise deployment.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
A Paradise affiliate distributed the ransomware through an IQY-file spam campaign. The campaign was identified as part of Paradise activity during 2020.
Bitdefender released another decryption tool for Paradise ransomware. The additional decryptor further reduced the effectiveness of Paradise campaigns against victims.
Emsisoft released a free decryption utility for Paradise ransomware, providing victims with a recovery option. This was cited as one factor in the later decline of Paradise activity.
Paradise ransomware was first discovered in 2017 and operated as a ransomware-as-a-service family. The malware was described as primarily targeting home users and smaller companies.
ASEC reported a recent Paradise ransomware intrusion in which the malware was likely installed after exploitation of outdated AweSun remote-control software. The activity was linked to a broader cluster that also used Sunlogin vulnerabilities to deploy Sliver C2, BYOVD tooling, XMRig, and likely Cobalt Strike.
After the leak, Bart Blaze compiled sample Paradise strains from the exposed source code and submitted them to ID-Ransomware. ID-Ransomware classified the resulting samples as undecryptable, highlighting the risk of code reuse by other actors.
The source code for the .NET version of Paradise ransomware, including the builder and decryption utility, was leaked on the Russian-speaking XSS hacking forum. Malware analysts Bart Blaze and MalwareHunterTeam verified the leaked files as authentic.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
labs.bitdefender.com
Open sourceasec.ahnlab.com
Open sourcetherecord.media
Open sourcelastline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro reported that the **Rapture** ransomware family was used in intrusions that likely began with exploitation of vulnerable public-facing web servers, with activity often originating from `w3wp.exe`. Operators carried out reconnaissance, deployed **Cobalt Strike** through PowerShell fetched from a command-and-control server, and abused `explorer.exe` with the `/NOUACCHECK` flag to gain elevated execution while keeping the intrusion chain relatively small and difficult to detect. Researchers said Rapture shares some traits with **Paradise** ransomware, including its RSA key configuration style and `.NET` execution requirements, but differs in behavior and only loosely resembles **Zeppelin** in its ransom note. The malware was commonly executed in memory instead of being written to disk, was packed with **Themida** to complicate analysis, and used hard-coded six-character strings in both ransom notes and encrypted filenames; observed attacks typically unfolded over **three to five days**.
Aug 15, 2026
**Ransomware activity is increasingly blending into normal IT operations** by combining exploitation of internet-facing software with the use of legitimate remote access and monitoring tools. Huntress reported multiple intrusions tied to the **Crazy** ransomware gang where attackers deployed *Net Monitor for Employees Professional* and the *SimpleHelp* remote support client to maintain persistence, evade detection, and stage for ransomware deployment. The actors installed the monitoring agent via `msiexec.exe` directly from the vendor site, then used it for interactive control (desktop viewing, file transfer, command execution); they also added redundant access by installing SimpleHelp via PowerShell and disguising binaries with benign-looking names (e.g., `vshost.exe`) and paths such as `C:\ProgramData\OneDriveSvc\OneDriveSvc.exe`. In parallel, ransomware groups have been observed **actively exploiting recently patched SmarterTools SmarterMail vulnerabilities** that enable unauthenticated compromise of mail servers. SC Media reported that CISA added **CVE-2026-24423** to the KEV catalog after it was linked to ransomware campaigns; the flaw enables unauthenticated RCE via SmarterMail’s `ConnectToHub` API by delivering a malicious OS command from a remote server. A second issue, **CVE-2026-23760**, allows authentication bypass through the password reset API (`force-reset-password`) by not validating the old password; ReliaQuest attributed active exploitation of this weakness to a China-based actor tracked as **Storm-2603**, which reportedly chained the bypass with SmarterMail’s *Volume Mount* feature to reach RCE, activity assessed as staging consistent with **Warlock** ransomware operations (even when ransomware was not yet deployed).
Jun 29, 2026
Researchers found an open directory and management panel tied to the **CRPX0** malware operation at `fanonlyatn[.]xyz`, exposing the full source code, backend infrastructure, and operator details for a malware-as-a-service platform. The leaked materials showed a three-part criminal toolkit: a cryptocurrency clipboard hijacker supporting 10 coins, a **BIP39** seed-phrase scanner and stealer, and ransomware for **Windows, macOS, and Linux** that appends the `.crpx0` extension. The code and panel also exposed plaintext secrets, including a shared dashboard API secret, a loader password, ten hardcoded wallet addresses, and contact points linked to the operator, including the Telegram handle **@DataBreachPlus**, `databreachplus@proton[.]me`, and a qTox ID. Analysis of the leaked infrastructure tied the operation to backup command-and-control and ransom-notification domains hosted on `31[.]31[.]198[.]206` through **REG.RU**, while the primary panel sat behind Cloudflare. The exposed files showed Windows routines to delete Volume Shadow Copies, macOS builder scripts aimed at bypassing Gatekeeper, and lures themed around fake **FedEx** shipping notices and fake **OnlyFans** account lists. Researchers also identified a separate exposed **TwizAdmin** panel at `103.241.66[.]238:1337` that pointed to additional infostealer functionality and suggested the campaign has been active since at least July 2025; one unusual artifact was ransomware wallpaper containing **C2PA** metadata indicating it had been generated with **ChatGPT/GPT-4**.
Jun 29, 2026