Loading story…
Researchers identified CryptoHost, also tracked as Manamecrypt, as a ransomware family that did not truly encrypt files but instead moved targeted data into a password-protected RAR archive and demanded 0.33 Bitcoin for recovery. The malware reportedly stored both the archive and its executable under AppData\Roaming, established persistence through a Run registry key, and verified exact ransom payments through blockchain.info before releasing files. It was also reported as being bundled with a uTorrent installer and detected by security products as Ransom:MSIL/Manamecrypt.A and Ransom_CRYPTOHOST.A.
Analysis of the malware showed the archive password was generated predictably from the archive name and the victim username, allowing affected files to be recovered without paying the ransom. Researchers also said the threat attempted to frustrate remediation by deleting the SafeBoot registry key and terminating processes associated with security tools, administration, gaming, shopping, and social-media applications. While some reports described the attacks as highly disruptive for users and companies, they also warned that ransom payment via Bitcoin remained risky and offered no guarantee of successful recovery, reinforcing the need for preventive security controls and backups.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Later reporting on Manamecrypt, also referred to as CryptoHost, stated that files from the current attacks could be decrypted and warned that paying the ransom in Bitcoin did not guarantee recovery. The report also noted investigators had not prominently observed the malware using a backdoor.
Observed infections showed CryptoHost being distributed through a bundled uTorrent installer that dropped cryptohost.exe into the victim's AppData folder and executed it. The malware then demanded 0.33 bitcoin for file recovery.
Security researcher Jack identified a new ransomware family called CryptoHost that did not truly encrypt files, but instead moved them into a password-protected RAR archive with a predictable password, making recovery possible without paying. Additional analysis was credited to Michael Gillespie and MalwareHunterTeam.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CryptoLocker** emerged as a highly disruptive ransomware operation that encrypted files with strong public-key cryptography, including data on local drives, removable media, and accessible network shares, then demanded roughly **$300/€300** in **Bitcoin** or MoneyPak for the private key. Victims were warned they had only about **72 hours** to pay before losing access permanently, and reports indicated that the malware’s encryption was generally not breakable, leaving organizations and consumers dependent on payment or unaffected backups. Security reporting also noted that some victims who paid did receive working decryption keys, while disruptions to command-and-control infrastructure sometimes prevented even paying victims from recovering files. The operators later added a **"second chance"** decryption portal that raised the price from **2 bitcoins** during the initial deadline to **10 bitcoins** after expiration, effectively turning the campaign into a more structured extortion service. Coverage linked the operation to the use of **Tor** and resilient backend infrastructure to conceal command systems and maintain contact with victims, while later reporting traced **millions of dollars in laundered Bitcoin** tied to the crimewave. The campaign underscored how ransomware actors were combining strong encryption, anonymous payment channels, and hidden services to industrialize file-encryption extortion at scale.
Jun 29, 2026
Sophos reported that the **Memento Team** gained initial access by exploiting an exposed **VMware vCenter Server** vulnerability, then remained in the victim environment for more than six months while stealing credentials, moving laterally over **RDP**, and exfiltrating data. During that dwell time, the same exposed server was also compromised by unrelated intruders who deployed **XMR** and **XMRig** cryptocurrency miners, underscoring the prolonged exposure of the environment. After a failed attempt to encrypt files directly, Memento reworked its malware to evade encryption protections by placing victim files into password-protected **WinRAR** archives, encrypting the archive passwords, and deleting the originals before issuing a ransom demand of about **$1 million in Bitcoin** and threatening to leak stolen data. Sophos said the payloads were **Python 3.9** programs packaged with **PyInstaller**, communicated with a command-and-control server at `78.138.105.150:11180`, and used ransom-note styling similar to **REvil** while directing victims to **Telegram**; the victim restored most systems from backups, and investigators recovered some files because endpoint telemetry captured archive passwords during the attack.
Aug 14, 2026
Sophos reported that the **Memento Team** compromised a victim network through an exposed, unpatched **VMware vCenter Server** and remained inside the environment for more than six months. The attackers conducted hands-on-keyboard operations over **RDP**, used tools including **Impacket**, **Mimikatz**, **Plink**, **Process Hacker**, **BCWipe**, and a Python keylogger, and also exfiltrated data while threatening to leak it publicly as part of a **$1 million** extortion demand. After an initial attempt to encrypt files was partly blocked by endpoint protection, the group changed tactics and used **password-protected WinRAR archives** to bypass encryption defenses: they copied victim files into encrypted archives, encrypted the archive passwords, and deleted the originals. Sophos said the same exposed vCenter server was also exploited by other intruders to deploy **XMR** and **XMRig** cryptocurrency miners during the intrusion window, while the victim ultimately restored most systems from backups and investigators recovered some files because security logs had captured the archive passwords.
Aug 14, 2026