Loading story…
Researchers reported that the KeyPass ransomware was actively distributed through fake software installers that fetched and launched the payload on Windows systems. The C++ malware copied itself into %LocalAppData%, deleted the original file, and spawned child processes using command-line arguments containing the victim ID and encryption key. It then encrypted files on local disks and reachable network shares, appended the .KEYPASS extension, and dropped ransom notes named !!!KEYPASS_DECRYPTION_INFO!!!.txt across affected directories.
Analysis showed that KeyPass used AES-256 in CFB mode with a zero IV and encrypted roughly the first 5 MB of each targeted file. The malware requested the encryption key and victim identifier from a command-and-control server over plain HTTP JSON, but if the server was unavailable it reverted to a hardcoded key and ID, leaving offline-encrypted files easily recoverable. Researchers also identified a hidden GUI that could be exposed with a special keypress, indicating the operators built in support for manual control and customizable encryption behavior.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Securelist published a technical analysis detailing KeyPass behavior, including its encryption routine, command-and-control communications, hidden GUI, and the weakness in its offline encryption fallback. The report also shared indicators of compromise including a sample hash and C2 URL.
Securelist reported that the KeyPass ransomware variant began spreading actively in August through fake installers that downloaded the ransomware payload. The report described this as a newly detected campaign observed by Securelist and others in the security community.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro reported that the **Kasseika** ransomware used a bring-your-own-vulnerable-driver (**BYOVD**) technique to compromise Windows environments, disable security tools, and encrypt victim files. In the investigated intrusion, the attackers reportedly gained initial access through targeted phishing, then used remote administration tools and **PsExec** for execution and lateral movement. The malware abused the signed but vulnerable `Martini.sys` driver from TG Soft’s VirIT Agent System to terminate antivirus and analysis processes, allowing the ransomware to run with reduced interference. The operation also employed anti-analysis checks, cleared Windows event logs, and deleted shadow copies before encrypting files with **ChaCha20** and **RSA** through CryptoPP. After encryption, Kasseika dropped ransom notes and changed the victim’s desktop wallpaper. Researchers said the malware shares multiple code and behavioral traits with **BlackMatter**, including ransom note naming conventions and apparent source-code overlap, indicating the operators may have obtained or reused parts of BlackMatter’s codebase.
Aug 15, 2026
Researchers identified **CryptoHost**, also tracked as **Manamecrypt**, as a ransomware family that did not truly encrypt files but instead moved targeted data into a password-protected **RAR** archive and demanded **0.33 Bitcoin** for recovery. The malware reportedly stored both the archive and its executable under `AppData\Roaming`, established persistence through a **Run** registry key, and verified exact ransom payments through **blockchain.info** before releasing files. It was also reported as being bundled with a **uTorrent** installer and detected by security products as **`Ransom:MSIL/Manamecrypt.A`** and **`Ransom_CRYPTOHOST.A`**. Analysis of the malware showed the archive password was generated predictably from the archive name and the victim username, allowing affected files to be recovered without paying the ransom. Researchers also said the threat attempted to frustrate remediation by deleting the **SafeBoot** registry key and terminating processes associated with security tools, administration, gaming, shopping, and social-media applications. While some reports described the attacks as highly disruptive for users and companies, they also warned that ransom payment via **Bitcoin** remained risky and offered no guarantee of successful recovery, reinforcing the need for preventive security controls and backups.
Aug 15, 2026
**ProLock** ransomware was used in targeted intrusions against organizations after attackers gained access through **QakBot**, phishing campaigns, and exposed or compromised **RDP** services. Reporting linked ProLock to the earlier **PwndLocker** family and described it as the final stage of a broader compromise in which operators conducted reconnaissance, abused legitimate Windows processes, and used batch scripts, **Task Scheduler**, and **PowerShell** to deploy the encryptor across victim environments. Once executed, ProLock disabled processes and services, deleted shadow copies, and encrypted files larger than `8,192` bytes while leaving the first `8,192` bytes intact before appending the `.prolock` extension and dropping ransom notes. The campaign drew additional scrutiny after the **FBI** warned that some victims who paid received a faulty decryptor that corrupted files instead of restoring them, underscoring both the operational risk of payment and the likelihood that data theft could accompany the encryption phase.
Aug 15, 2026