Loading story…
The operators behind Mamba ransomware resumed attacks against corporate networks, using the legitimate DiskCryptor utility to lock entire disks rather than just individual files. After gaining access to a victim environment, the attackers used PsExec to spread the malware across machines, then installed DiskCryptor components, a driver, and a malicious auto-start service before forcing a reboot.
On the next stage, Mamba modified the MBR bootloader, encrypted disk partitions, and rebooted systems again to present a ransom note. Each infected machine received a unique DiskCryptor password passed to the dropper through command-line arguments, making recovery effectively impossible without the attacker-held key because DiskCryptor relies on strong encryption. The campaign follows the group’s earlier use of the malware in the San Francisco Municipal Transportation Agency incident, underscoring the continued threat posed by disk-encrypting ransomware in enterprise environments.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
On 2021-03-23, the FBI, in coordination with DHS-CISA, issued Alert CU-000143-MW on Mamba ransomware. The alert described Mamba’s use of DiskCryptor against multiple sectors, published technical indicators and mitigations, and noted that responders may recover the encryption password from myConf.txt before the second reboot.
Mamba ransomware was used in a major 2016 attack against San Francisco’s Municipal Transportation Agency, establishing the malware’s earlier known use before the renewed activity described in the report.
The Securelist report says the threat actor behind Mamba resumed targeting corporate networks. It also disclosed technical details of the malware’s deployment, including use of PsExec and the legitimate DiskCryptor utility for full-disk encryption.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Ransomware operators have repeatedly used tools and policy abuse to disable Microsoft Defender before encrypting Windows environments. DFIR reporting documented the freeware utility **Defender Control** being used in real intrusions by groups such as **Dharma**, **Phobos**, and **Crysis**, typically after access through exposed RDP, to turn off Defender through registry edits, service changes, driver unloading, and local group policy modifications. Separately, **LockBit 2.0** automated the same objective at enterprise scale by creating malicious Active Directory group policies on a domain controller, disabling Defender across domain-joined systems, and launching ransomware via scheduled tasks after enumerating hosts with AD and LDAP queries. More recent intrusions show the tactic evolving beyond simple utilities into **BYOVD** and broader policy abuse. WithSecure reported that the **CrazyHunter** ransomware actor used the vulnerable **Zemana Anti-Logger** driver `zam64.sys` to disable both Windows Defender and Trend Micro during attacks on Taiwanese hospitals and industrial organizations, including the Mackay Memorial Hospital incident. The operation also used publicly available tooling such as **SharpGPOAbuse** for lateral movement and persistence, reinforcing that defense evasion through Defender tampering and group policy manipulation remains a practical, low-barrier technique for ransomware actors ranging from smaller crews to more organized operators.
Aug 14, 2026
**Matrix ransomware** has targeted small- to medium-sized organizations in multiple countries since its public emergence in 2016, with its delivery methods shifting over time from spam emails, malicious Windows shortcut files, and the **RIG exploit kit** to the brute forcing of weak **Remote Desktop Protocol (RDP)** credentials. The campaign reflects a broader move toward targeted ransomware intrusions that rely on exposed remote access services rather than mass distribution alone. Once launched, Matrix encrypts local files and network shares, deletes volume shadow copies, disables recovery options, and demands payment in **Bitcoin**. Operators use a variable ransom model in which victims are told to make contact and provide sample files for decryption so the attackers can assess payment demands; known variants use multiple file extensions, including the **Fox** strain that appends `.FOX` to encrypted files.
Aug 14, 2026