Loading story…
Nucleus Software Exports, an Indian lending software provider serving banks and retail lenders, disclosed a ransomware attack that disrupted parts of its internal network and encrypted sensitive business information. The malware was identified as BlackCocaine / EpsilonRed, a newly observed ransomware family, and the company reported the incident to Indian financial regulators and the National Stock Exchange. Nucleus said it does not store customers’ financial data and did not expect any client financial data leakage, while leaving unanswered whether a ransom was paid or exactly how the attackers first gained access.
Research from Sophos tied EpsilonRed to hands-on intrusions that likely began through unpatched Microsoft Exchange servers vulnerable to ProxyLogon. In observed attacks, operators used WMI and a PowerShell orchestrator to spread tooling, create scheduled tasks, delete shadow copies, clear event logs, disable protections, kill processes that could block encryption, and preserve remote access by leaving RDP and Remote Utilities ports open. The final payload, a Go-based Windows binary, broadly encrypted files, appended the .epsilonred extension, and dropped a ransom note; Sophos also linked the group to at least one payment of 4.29 BTC after a successful compromise.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Nucleus Software Exports experienced a ransomware attack that disrupted parts of its internal network and encrypted sensitive business information. The malware used in the incident was identified by the cybersecurity community as BlackCocaine, also known as Epsilon Red.
Sophos published research on a new Go-based ransomware family called Epsilon Red, observed in a hands-on intrusion against a US hospitality business. The report linked the activity to likely exploitation of an unpatched Microsoft Exchange server and detailed the attackers' PowerShell-heavy deployment chain.
Sophos reported that, based on a cryptocurrency address in the ransom note, at least one victim paid 4.29 BTC in ransom, worth about $210,000 at the time.
In a quarterly report filed on Thursday, Nucleus Software said it was containing the damage from the ransomware incident and recovering and restoring affected systems. The company had not confirmed the initial access vector or whether any ransom was paid.
Nucleus Software disclosed the ransomware incident in a filing with the Indian National Stock Exchange. The company said it does not store customers' financial data and told regulators no leakage or loss of client financial data was expected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Kingdom ransomware was deployed against unpatched on-premises Microsoft Exchange servers after attackers exploited the **ProxyLogon** chain, particularly `CVE-2021-27065`, and installed web shells for remote access. Reporting from multiple security firms says the operators used shells including `ChackLogsPL.aspx`, `ckPassPL.aspx`, `hackIdIO.aspx`, and in some cases **China Chopper**, then launched the payload through PowerShell, WMI, and downloads from infrastructure such as `yuuuuu44[.]com`. Trend Micro also linked ProxyLogon exploitation to other malware families including **LemonDuck** and **Prometei**, showing that Exchange compromises quickly became a shared delivery path for ransomware, coinminers, and botnets. Researchers described Black Kingdom as a relatively crude Python ransomware built with **PyInstaller**, but still disruptive: it encrypted files, could encrypt them multiple times, stopped SQL-related services, deleted Windows Event Logs, and displayed a ransom note demanding **$10,000 in Bitcoin**. Analysis found the malware uploaded victim IDs and encryption keys to **Mega**, but fell back to a hardcoded key if that failed, creating a significant cryptographic weakness that may allow recovery in some cases. Additional reporting tied the campaign to random encrypted-file extensions, shared payment infrastructure, possible data-theft extortion claims, and at least one likely ransom payment, while analysts assessed the Exchange attacks as largely opportunistic rather than confidently attributable to a known threat actor.
Aug 15, 2026
Sophos reported that two organizations hit by **Entropy ransomware** were first compromised through intrusions involving **Dridex** and remote-access tooling such as **Cobalt Strike**. One attack targeted a North American media company through **ProxyShell** exploitation and unfolded over roughly four months, while another began with a malicious email attachment sent to a regional government organization and escalated to data exfiltration in about 75 hours. In both cases, the attackers relied on widely available administrative and commercial tools for lateral movement, staging, and theft, including **PsExec**, **PsKill**, **AdFind**, **WinRAR**, **ScreenConnect**, and cloud storage services. Reverse-engineering of the malware found notable similarities between Entropy and Dridex, including shared packer behavior, vectored exception handler setup, string decryption, and API resolution logic. Sophos said the overlap may indicate a development relationship and also noted packer detections previously tied to **DoppelPaymer**, adding to evidence that Entropy could belong to the ransomware lineage associated with **Evil Corp**. The findings underscore how unpatched internet-facing systems and weak authentication can enable long-running intrusions that end in ransomware deployment and data theft.
Aug 14, 2026
A newly identified ransomware operation known as **RedAlert**, also referenced internally as **N13V**, has been observed targeting corporate networks by encrypting both **Windows** systems and **Linux-based VMware ESXi** servers. The Linux variant is built specifically for ESXi environments and can forcibly shut down running virtual machines before encrypting VM-related files, while encrypted data is renamed with a `.crypt[number]` extension and accompanied by a `HOW_TO_RESTORE` ransom note containing a Tor payment link. Researchers reported that the malware uses the **NTRUEncrypt** public-key algorithm and already shows relatively mature cross-platform capabilities despite appearing to be a newer operation. RedAlert is also conducting **double-extortion** attacks, stealing data before encryption and threatening to publish it on a leak site if victims refuse to pay. Reporting on broader ransomware trends placed RedAlert alongside newer groups such as **0mega** and **Lilith**, underscoring a rise in emerging crews with increasingly capable tooling. In that wider landscape, RedAlert stood out for its focus on enterprise virtualization infrastructure, especially ESXi hosts, adding to concerns that ransomware operators are continuing to prioritize high-impact targets that can disrupt large numbers of systems at once.
Aug 15, 2026