Loading story…
Researchers identified White Rabbit as a newly observed ransomware family after it was used in a targeted attack against a U.S. bank. The malware employed double extortion, encrypting files while also pressuring victims with data-theft threats, and it traversed fixed, removable, and network drives while avoiding system-critical paths that could destabilize infected hosts. Before encryption, White Rabbit terminated security-related processes to reduce detection and disruption.
Trend Micro reported that the ransomware’s most unusual feature was a payload that required a specific command-line password to decrypt its internal configuration and activate, causing the sample to appear inactive during casual analysis and complicating sandboxing efforts. The intrusion also showed tradecraft associated with FIN8, including telemetry involving Cobalt Strike, a malicious URL reportedly tied to the group, and a previously unseen Badhatch variant, while researchers assessed the malware itself appeared comparatively simple and possibly still under development despite its effective evasion techniques.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that the newly observed White Rabbit ransomware was used in an attack against a local U.S. bank in December 2021. The intrusion involved double-extortion tactics and telemetry that suggested use of Cobalt Strike during the operation.
Trend Micro published an analysis of the White Rabbit ransomware family, describing its password-gated payload behavior, process-killing and encryption logic, and similarities to Egregor. The report also shared indicators of compromise including a SHA-256 hash and a malicious URL, and noted a possible but unconfirmed link to FIN8.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**WhiteLock** ransomware has been identified targeting Windows systems, encrypting files and appending the `.Fbin` extension before dropping a ransom note named `c0ntact.Txt` and changing the victim’s wallpaper to increase pressure to pay. During execution, the malware contacts an external server, derives a victim identifier by hashing the device’s MAC address, retrieves an RSA public key, and encrypts files with **AES-CBC** while protecting the AES key with **RSA-2048**. The operation also attempts to hinder containment by checking for **AnyDesk** and **TeamViewer** and terminating their services while encryption is underway. The ransom note claims both file encryption and data theft, threatens to publish or sell stolen data if payment is not made, and directs victims to a Tor-based negotiation page. Reporting also links WhiteLock activity to campaigns where information-stealing malware was used for initial access before ransomware deployment, underscoring the need to monitor abnormal outbound connections, remote access tool activity, mass file changes, ransom note creation, and service termination behavior.
Jul 8, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026
FortiGuard Labs said the **DeathRansom** ransomware campaign is strongly tied to **Vidar** stealer activity and several other malware operations through shared infrastructure, naming conventions, and recurring attribution artifacts. Researchers found Vidar samples attempting to access Bitbucket paths under the profile name **`scat01`** and likely retrieving DeathRansom variants named in the **`Wacatac_YYYY-MM-DD_HH-MM.exe`** format. The same cluster was also linked to **Azorult**, **Evrial stealer**, **1ms0rryStealer**, and **Supreme miner**, with repeated use of identifiers including the nickname **`scat01`**, the email **`vitasa01@yandex.ru`**, and the domain **`gameshack[.]ru`**. FortiGuard assessed that false Slovak and Nepali language artifacts were likely planted to mislead investigators, while other evidence pointed to a Russian-speaking operator associated with the online persona **SoftEgorka** and likely connected to **Egor Nedugov** from the Rostov-on-Don/Aksay area. Separate technical profiling described DeathRansom, also detected in some cases as **Wacatac**, as a ransomware family that evolved from early variants that sometimes only mimicked encryption into later builds that performed real file encryption. The malware primarily targeted English-speaking users, dropped a **`read_me.txt`** ransom note, demanded Bitcoin payment through attacker-controlled email addresses, and checked systems against a whitelist of CIS-region languages before running. Analysts documented multiple delivery paths, including **RDP compromise**, spam, malicious downloads, botnets, exploits, malvertising, fake updates, and trojanized installers, and noted changing cryptographic implementations involving **Curve25519/ECDH**, **Salsa20**, **RSA-2048**, **AES**, and **SHA-256**. The reporting also noted code or family relationships with **EZDZ-Locker**, **TechandStrat**, **HelloKitty**, **FiveHands**, **DCRTR**, and **STOP** ransomware.
Aug 15, 2026