Loading story…
Researchers reported that a server believed to be operated by the developers of the Kuiper ransomware exposed source code, decryption keys, control tooling, and exfiltrated victim data, offering an unusual inside view of the ransomware-as-a-service operation. Kuiper was marketed on underground forums from September 2023 by an actor using the name RobinHood, which allegedly promised affiliates 90% of profits along with data-theft and cryptocurrency-mixing support. Stairwell said logs on the recovered server tied infections to 29 unique IP addresses across 11 countries and showed activity from Russian IP space despite the group’s stated ban on targeting CIS entities; the firm also recovered 10 private keys and said organizations hit before 4 December 2023 could obtain compiled decryptors.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Trellix published an analysis of Kuiper on January 17, 2024. The report said the malware's advertised capabilities were exaggerated, documented versions A, B, and C, and described added propagation and Windows-focused functionality in later builds.
On 1 December 2023, Stairwell researchers acquired a server they believed was operated by Kuiper's developers. The server contained source code, decryption keys, control tooling, and exfiltrated data.
Logs from a cracked Cobalt Strike instance tied to Kuiper showed activity from 21 November 2023 through 1 December 2023. Stairwell said the logs reflected infections associated with 29 unique IP addresses in 11 countries, including Russian IP space despite the group's stated CIS targeting ban.
On September 22, 2023, the actor RobinHood advertised Kuiper on an underground forum. The post claimed the ransomware was ready to use, offered operational help for a commission, and promoted double-extortion capabilities despite the leak site not being finished.
Kuiper was first observed in September 2023 as a new ransomware-as-a-service operation. The malware family was described as Golang-based and marketed by the actor using the RobinHood moniker.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers found an open directory and management panel tied to the **CRPX0** malware operation at `fanonlyatn[.]xyz`, exposing the full source code, backend infrastructure, and operator details for a malware-as-a-service platform. The leaked materials showed a three-part criminal toolkit: a cryptocurrency clipboard hijacker supporting 10 coins, a **BIP39** seed-phrase scanner and stealer, and ransomware for **Windows, macOS, and Linux** that appends the `.crpx0` extension. The code and panel also exposed plaintext secrets, including a shared dashboard API secret, a loader password, ten hardcoded wallet addresses, and contact points linked to the operator, including the Telegram handle **@DataBreachPlus**, `databreachplus@proton[.]me`, and a qTox ID. Analysis of the leaked infrastructure tied the operation to backup command-and-control and ransom-notification domains hosted on `31[.]31[.]198[.]206` through **REG.RU**, while the primary panel sat behind Cloudflare. The exposed files showed Windows routines to delete Volume Shadow Copies, macOS builder scripts aimed at bypassing Gatekeeper, and lures themed around fake **FedEx** shipping notices and fake **OnlyFans** account lists. Researchers also identified a separate exposed **TwizAdmin** panel at `103.241.66[.]238:1337` that pointed to additional infostealer functionality and suggested the campaign has been active since at least July 2025; one unusual artifact was ransomware wallpaper containing **C2PA** metadata indicating it had been generated with **ChatGPT/GPT-4**.
Jun 29, 2026
The **Yanluowang** ransomware operation targeted U.S. organizations, with a particular focus on the financial sector, using **BazarLoader** during reconnaissance and initial compromise before expanding access through enabled RDP and remote-management tools such as **ConnectWise**. Intrusions documented by Symantec and linked reporting showed the actors conducting network discovery with tools including **AdFind** and **SoftPerfect Network Scanner**, while also deploying credential-theft and data-exfiltration utilities ahead of ransomware deployment. U.S. government reporting on **FiveHands** provides additional context for tradecraft overlaps that researchers said may indicate ties to earlier ransomware-as-a-service activity, though direct shared authorship was not confirmed. A later leak of Yanluowang internal chats, infrastructure details, and source code exposed a more structured criminal enterprise, with separate roles for development, negotiations, social engineering, pentesting, and DDoS operations. The leaked material suggested links to **Thieflock**, **PayloadBIN**, **Conti**, and references to **REvil**, while indicating the group avoided targets in former Soviet states and took steps to discuss operational security and money laundering. Researchers said the leak appears to have disrupted the gang’s operations, with onion sites reportedly going offline, but warned that publication of the ransomware source code and builder could aid both defenders and future threat actors seeking to reuse the tooling.
Aug 15, 2026
The **Paradise** ransomware operation, a long-running ransomware-as-a-service family first seen in 2017, drew renewed concern after the source code for its **.NET** variant was leaked on the Russian-speaking XSS forum. Researchers said the leak included the Paradise builder and a decryption utility, and analysts verified the files as authentic. Although the .NET branch had seen more limited use than the native Paradise version, newly built samples were reportedly being classified as undecryptable, raising the risk that additional threat actors could repurpose the code against home users and small businesses. Subsequent intrusions showed Paradise being deployed through suspected exploitation of outdated **AweSun** remote-control software, alongside activity involving **Sunlogin** flaws, **Sliver C2**, **Cobalt Strike**, BYOVD tooling, and **XMRig**. In one analyzed case, the ransomware used **RSA-1024** encryption, deleted Volume Shadow Copies, set persistence through a Windows `Run` key, prioritized database and backup paths for encryption, and sent victim metadata to a command-and-control endpoint before dropping a ransom note tied to the email **main@paradisenewgenshinimpact.top** and a Bitcoin wallet. Defenders were urged to patch exposed remote-access software and maintain endpoint protections to reduce the risk of Paradise deployment.
Aug 15, 2026