Loading story…
Cisco Talos reported an ongoing ransomware campaign by an unidentified threat actor, assessed with moderate confidence to be of Vietnamese origin, using a customized Yashma payload derived from Chaos ransomware v5. The actor has targeted organizations across English-speaking countries as well as Bulgaria, China, and Vietnam, and attempted to imitate WannaCry through its ransom note language and desktop wallpaper. The campaign stood out for using multilingual ransom notes hosted in an attacker-controlled GitHub repository rather than embedding the text directly in the malware binary.
The modified ransomware also used persistence mechanisms including the Windows Run registry key and a startup-folder .url file that pointed to %AppData%\Roaming\svchost.exe. Talos said the malware preserved Yashma’s anti-recovery behavior by overwriting original files with a question mark character before deleting them, making forensic recovery more difficult. Reporting on the broader Chaos/Yashma lineage indicates the operation relied on a known ransomware family that has been reworked for customized deployment and evasion.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos reported that the unidentified threat actor's ransomware operation had been active since at least June 4, 2023, targeting victims in English-speaking countries, Bulgaria, China, and Vietnam with a customized Yashma variant.
On June 4, 2023, the actor created a public GitHub repository named "Ransomware" under the account "nguyenvietphat" to host multilingual ransom note files downloaded by the malware.
The unidentified ransomware actor's customized Yashma sample was compiled on June 4, 2023, marking the earliest explicit technical anchor for the campaign activity described by Talos.
Chaos ransomware v5, the family from which Yashma was later rebranded, appeared in May 2022 according to the Talos reference.
Cisco Talos disclosed an ongoing ransomware campaign using a customized Yashma variant and assessed with moderate confidence that the actor may be of Vietnamese origin, while detailing the malware's GitHub-based ransom note delivery and persistence mechanisms.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that **RuRansom** is a destructive malware strain aimed at systems geolocated in Russia, presenting itself as ransomware while functioning primarily as a wiper. The malware checks a victim’s public IP address through external services and exits unless the host appears to be in Russia, then seeks elevated privileges, scans local, removable, and network drives, deletes `.bak` backup files, and encrypts files with **AES/AES-CBC** while appending the `.fs_invade` extension. It also drops a Russian-language note stating there is no decryption or payment path, underscoring that the operation is intended to damage Russian victims rather than extort them. Researchers said the malware is a **.NET 32-bit PE** sample that can spread in worm-like fashion across connected systems and USB devices, including by copying itself as `Россия-Украина_Война-Обновление.doc.exe`. Trend Micro linked RuRansom to the developer behind **dnWipe** and a downloader for **XMRig**, suggesting an actor experimenting with multiple destructive and financially motivated tools, while noting attribution remains unconfirmed. VMware and Cyble also described multiple variants that attempt privilege escalation and appear to have been developed during the Russia-Ukraine cyber conflict, with encrypted files considered effectively irreversible.
Aug 15, 2026
The **Yanluowang** ransomware operation targeted U.S. organizations, with a particular focus on the financial sector, using **BazarLoader** during reconnaissance and initial compromise before expanding access through enabled RDP and remote-management tools such as **ConnectWise**. Intrusions documented by Symantec and linked reporting showed the actors conducting network discovery with tools including **AdFind** and **SoftPerfect Network Scanner**, while also deploying credential-theft and data-exfiltration utilities ahead of ransomware deployment. U.S. government reporting on **FiveHands** provides additional context for tradecraft overlaps that researchers said may indicate ties to earlier ransomware-as-a-service activity, though direct shared authorship was not confirmed. A later leak of Yanluowang internal chats, infrastructure details, and source code exposed a more structured criminal enterprise, with separate roles for development, negotiations, social engineering, pentesting, and DDoS operations. The leaked material suggested links to **Thieflock**, **PayloadBIN**, **Conti**, and references to **REvil**, while indicating the group avoided targets in former Soviet states and took steps to discuss operational security and money laundering. Researchers said the leak appears to have disrupted the gang’s operations, with onion sites reportedly going offline, but warned that publication of the ransomware source code and builder could aid both defenders and future threat actors seeking to reuse the tooling.
Aug 15, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026