Loading story…
Researchers detailed Cyrat, a Python-based ransomware strain that masqueraded as a DLL repair tool and primarily targeted English-speaking users while remaining capable of wider global spread. After execution, the malware encrypted files in common user directories, appended the .CYRAT extension, and dropped RANSOME_NOTE.txt ransom notes demanding $1,000 in Bitcoin, with a reduced $500 payment offer if victims paid within two days.
Technical analysis found that Cyrat used Fernet symmetric encryption via PyCryptodome to encrypt entire files, then protected the Fernet key with an RSA public key downloaded from MediaFire rather than embedding it in the sample. The encrypted key was stored in EMAIL_US.txt for victims to send back to the attackers, and the malware also downloaded an image, saved it as background_img.png, and changed the desktop wallpaper to draw attention. Researchers noted Cyrat had relatively low prevalence and contained coding flaws, including extension-matching issues and a reported Pyfiglet-related crash that could disrupt encryption.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A Cyrat ransom note referenced a payment deadline of Aug-27-2020 and demanded $1,000 in Bitcoin, with a reduced $500 payment if paid within two days. Victims were instructed to contact officialintuitsoftware@gmail.com and send EMAIL_US.txt.
The Cyrat ransomware family was observed active in the second half of August 2020. It is described as a Python-based ransomware targeting primarily English-speaking users while capable of spreading globally.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **FuxSocy Encryptor** as a ransomware family that closely imitates the defunct **Cerber** strain in both presentation and parts of its internal logic. The malware encrypts victim files with **AES**, scrambles or renames filenames in Cerber-like patterns, drops ransom notes such as `***__READ___THIS__***.txt`, and can change the desktop wallpaper after locking data. Analysis found it skips or prioritizes certain folders, includes anti-virtual-machine checks, and in some variants partially encrypts files beginning at offset `0x708`, a technique that still leaves many documents unusable. The operators initially directed victims to make contact through **qTox/ToxChat** rather than a Tor payment portal, later shifting some variants to email addresses including `king-size_banana@thesecure.biz` and `fuxsocy@cockl.li`. Reporting on later samples shows the family remained active in subsequent years with variants using extensions such as `.b58d`, while likely relying on common intrusion routes including exposed **RDP**, phishing emails, malicious attachments, fake downloads, exploits, malvertising, and trojanized installers. No free decryptor was available in the early reporting, and victims were advised to recover from backups instead of paying the ransom.
Aug 15, 2026
FortiGuard Labs said the **DeathRansom** ransomware campaign is strongly tied to **Vidar** stealer activity and several other malware operations through shared infrastructure, naming conventions, and recurring attribution artifacts. Researchers found Vidar samples attempting to access Bitbucket paths under the profile name **`scat01`** and likely retrieving DeathRansom variants named in the **`Wacatac_YYYY-MM-DD_HH-MM.exe`** format. The same cluster was also linked to **Azorult**, **Evrial stealer**, **1ms0rryStealer**, and **Supreme miner**, with repeated use of identifiers including the nickname **`scat01`**, the email **`vitasa01@yandex.ru`**, and the domain **`gameshack[.]ru`**. FortiGuard assessed that false Slovak and Nepali language artifacts were likely planted to mislead investigators, while other evidence pointed to a Russian-speaking operator associated with the online persona **SoftEgorka** and likely connected to **Egor Nedugov** from the Rostov-on-Don/Aksay area. Separate technical profiling described DeathRansom, also detected in some cases as **Wacatac**, as a ransomware family that evolved from early variants that sometimes only mimicked encryption into later builds that performed real file encryption. The malware primarily targeted English-speaking users, dropped a **`read_me.txt`** ransom note, demanded Bitcoin payment through attacker-controlled email addresses, and checked systems against a whitelist of CIS-region languages before running. Analysts documented multiple delivery paths, including **RDP compromise**, spam, malicious downloads, botnets, exploits, malvertising, fake updates, and trojanized installers, and noted changing cryptographic implementations involving **Curve25519/ECDH**, **Salsa20**, **RSA-2048**, **AES**, and **SHA-256**. The reporting also noted code or family relationships with **EZDZ-Locker**, **TechandStrat**, **HelloKitty**, **FiveHands**, **DCRTR**, and **STOP** ransomware.
Aug 15, 2026
Sophos reported that the **Memento Team** gained initial access by exploiting an exposed **VMware vCenter Server** vulnerability, then remained in the victim environment for more than six months while stealing credentials, moving laterally over **RDP**, and exfiltrating data. During that dwell time, the same exposed server was also compromised by unrelated intruders who deployed **XMR** and **XMRig** cryptocurrency miners, underscoring the prolonged exposure of the environment. After a failed attempt to encrypt files directly, Memento reworked its malware to evade encryption protections by placing victim files into password-protected **WinRAR** archives, encrypting the archive passwords, and deleting the originals before issuing a ransom demand of about **$1 million in Bitcoin** and threatening to leak stolen data. Sophos said the payloads were **Python 3.9** programs packaged with **PyInstaller**, communicated with a command-and-control server at `78.138.105.150:11180`, and used ransom-note styling similar to **REvil** while directing victims to **Telegram**; the victim restored most systems from backups, and investigators recovered some files because endpoint telemetry captured archive passwords during the attack.
Aug 14, 2026