Loading story…
Attackers used the low-cost Philadelphia ransomware to run targeted campaigns against healthcare institutions and other organizations in the same city, delivering malware through spoofed internal-looking emails themed around patients and linked via bit.do URLs. The operation stood out because ransom notes were customized with victim organization names, demanded 15 Bitcoin, and threatened to delete files on a timed schedule, showing a level of personalization more often associated with higher-end ransomware operations.
Proofpoint reported that Philadelphia supported multiple delivery paths, including zipped executables linked from emails, macro-enabled Word documents that launched PowerShell, bundled installers on keygen and cracking sites, and distribution through the Sundown and RIG exploit kits. Its server-side configuration let operators set ransom amounts, Bitcoin addresses, victim IDs, and payment confirmation requirements, underscoring how commodity ransomware had evolved into a flexible platform for more tailored and aggressive attacks.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Proofpoint reported that the Philadelphia ransomware variant was first observed in September of the previous year. The malware was notable for being easy for low-skill actors to customize and deploy.
Proofpoint reported Philadelphia ransomware being bundled with keygen programs and Bitcoin-related software on keygen and cracking sites. The malware was also observed distributed through the Sundown and RIG exploit kits.
The report states this was the first observed instance of Philadelphia ransomware customizing ransom notes for a named victim organization. This showed operators could personalize extortion demands beyond generic commodity ransomware behavior.
Proofpoint described a related healthcare campaign by the same actor in which URLs led victims to macro-enabled Microsoft Word documents. One document, CV.doc, used macros and PowerShell to download Philadelphia ransomware.
A recent campaign targeted specific healthcare institutions and other organizations in the same city using spoofed internal-looking emails with patient-themed lures and bit.do links. In at least one case, the attackers customized the ransom note with the victim organization's name, demanded 15 Bitcoin, and threatened to delete 99 files every 45 minutes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**DoppelPaymer** ransomware operators used phishing emails, malicious attachments, and links to gain initial access, often chaining infections through **Emotet** and **Dridex** before deploying the final payload. After compromise, the attackers used tools including **PowerShell Empire**, **Cobalt Strike**, **PsExec**, and **Mimikatz** to steal credentials, move laterally, disable security controls, and prepare systems for encryption. The malware encrypted files on network, fixed, and removable drives, changed user passwords, rebooted systems into safe mode, and displayed a ransom note warning that stolen sensitive data could be leaked publicly. The campaign disproportionately affected **healthcare, emergency services, and education** organizations, with reported incidents including a German hospital, a county **E911** center, community colleges, and police and emergency services in a U.S. city. The activity highlighted a double-extortion model in which operational disruption was paired with data-theft pressure, while defenders were urged to harden email security, maintain offline backups, patch exposed systems, audit privileged accounts, monitor network traffic, enable **2FA**, and enforce least-privilege access.
Aug 14, 2026
Several new ransomware groups and campaigns have emerged, demonstrating increased sophistication and targeting a range of organizations globally. The SafePay group has established itself as a major threat by operating as a centralized, closed ransomware operation, eschewing the typical Ransomware-as-a-Service (RaaS) model. SafePay employs double extortion tactics, exfiltrating sensitive data before encrypting systems, and leverages rapid attack chains that often move from initial access to full encryption within 24 hours. Their methods include exploiting compromised credentials, misconfigured firewalls, and deploying backdoors for persistence, with a focus on operational security to avoid law enforcement detection. Other notable threats include the CrazyHunter ransomware, which has aggressively targeted healthcare organizations in Taiwan using advanced evasion techniques and multi-stage attacks that exploit Active Directory and propagate via Group Policy Objects. Meanwhile, the Ransomhouse group, operated by Jolly Scorpius, has upgraded its capabilities with a dual-key encryption system and automated attacks on VMware ESXi hypervisors, particularly focusing on German enterprises. These campaigns highlight a trend toward more targeted, technically advanced ransomware operations that prioritize both data theft and rapid system disruption, posing significant risks to critical infrastructure and sensitive industries.
Jun 29, 2026
A surge in sophisticated cyberattacks has been observed, with threat actors employing a variety of tactics to compromise organizations and individuals. Notable incidents include the use of the BYOVD (Bring Your Own Vulnerable Driver) technique to deploy DeadLock ransomware, as well as targeted campaigns leveraging phishing emails with HR-related lures to distribute Remcos RAT malware. Additionally, attackers are exploiting popular movie torrents to spread Agent Tesla via layered PowerShell scripts, and Android users in Spain are being targeted by the DroidLock ransomware, which can hijack devices and demand ransom through full-screen overlays. These campaigns demonstrate a trend toward multi-stage infection chains, abuse of legitimate tools and drivers, and the use of social engineering to increase the likelihood of successful compromise. Other significant developments include the targeting of Canadian organizations by the STAC6565/Gold Blade group using QWCrypt ransomware, and the emergence of new threat actor tactics such as disabling endpoint detection and response (EDR) systems to facilitate ransomware deployment. The threat landscape is further complicated by the activities of groups like Scattered Lapsus$ Hunters, who use social engineering and typosquatted domains to compromise Zendesk users, and the exposure of internal dynamics within ransomware groups like BlackBasta, revealing operational stress and internal mistrust. These incidents underscore the evolving nature of cyber threats, the blending of espionage and financial motives, and the increasing sophistication of both technical and social attack vectors.
Jun 29, 2026