Loading story…
Cyble Research Labs detailed VENOMOUS ransomware, a Python-based x64 console executable that encrypts victim files with AES-256, appends a VENOMOUS-themed extension, and drops a ransom note named SORRY-FOR-FILES.txt. The malware uses a configuration file to store a victim-specific ID and requires an operator to supply an encryption key at runtime, indicating a likely manual deployment model or affiliate-driven operation rather than fully automated mass distribution. Each encrypted file contains a unique IV, and victims are directed to contact the operators through a Tor site, Telegram, and a Tutanota email address, with payment demanded in Bitcoin.
The ransomware also attempts to improve encryption impact by terminating MSSQL, MySQL, and other SQL-related processes before locking files, a behavior aligned with MITRE ATT&CK T1562.001 for impairing defenses by disabling or modifying tools and services. By stopping database services that could otherwise keep files locked or in use, VENOMOUS increases the likelihood of successful encryption across enterprise environments and raises the operational disruption caused by an intrusion.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Cyble Research Labs identified and analyzed a ransomware family named VENOMOUS, detailing its Python-based payload, AES-256 file encryption, ransom note behavior, and victim communication channels. The report also documented process-killing behavior targeting MSSQL, MySQL, and related SQL services.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed an active **Weaxor** ransomware campaign targeting enterprise **Microsoft SQL Server** environments, particularly internet-exposed or misconfigured servers with weak administrator credentials. The operation is described as the late-2024 rebrand and successor to the **Mallox/TargetCompany** ransomware family and is reportedly run as a **ransomware-as-a-service** platform. In the observed intrusion chain, attackers abused SQL Server features including `xp_cmdshell` and **OLE Automation Procedures** to trigger a heavily obfuscated PowerShell loader, which decrypted and downloaded a second-stage payload identified as `update.exe`. The second stage deployed a **Cobalt Strike Beacon** in memory, using techniques such as dynamic API resolution, PEB traversal, `ROR13` API hashing, and **WinINet** communications to retrieve additional payloads from remote infrastructure, including `154.201.236.197`, while reducing static detection. The final payload injected into the legitimate signed SQL administration utility `SQLPS.exe`, launched ransomware from a randomized path under `C:\Windows\System32`, encrypted files with a custom **ChaCha20** implementation, appended the `.weax` extension, and cleared Windows event logs through `wevtapi.dll`, hindering forensic reconstruction and attribution.
Aug 15, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
**Snake** (also known as **EKANS**) was used in targeted intrusions against industrial organizations, including reported victims such as **Honda** and **Enel Group**, with malware samples customized for specific environments. Analysis showed the ransomware embedded an internal domain name and expected IP address, then encrypted files only if DNS resolution matched the hard-coded value, indicating deliberate victim validation and an effort to prevent execution outside the intended network. Researchers assessed the ransomware was typically deployed as the final stage of a multistage compromise after attackers obtained privileged access, likely including compromised domain administrator credentials used to spread the payload through domain policies. Technical analysis of a Golang-based, Gobfuscate-obfuscated sample found Snake checked the victim environment through WMI and avoided encrypting **primary** or **backup domain controllers**, instead dropping a ransom note, while using those systems to preserve propagation capability. On non-controller hosts, the malware enabled and reconfigured Windows Firewall, killed numerous security and industrial-related processes and services, deleted shadow copies, and encrypted files using per-file **AES-CTR** keys protected with **RSA-2048 OAEP**; encrypted files were marked with the string `EKANS`. The malware also retained behavior relevant to operational technology environments, including attempts to terminate **General Electric ICS-related processes**, reinforcing concerns about its impact on industrial operations.
Aug 15, 2026