Loading story…
Matrix ransomware has targeted small- to medium-sized organizations in multiple countries since its public emergence in 2016, with its delivery methods shifting over time from spam emails, malicious Windows shortcut files, and the RIG exploit kit to the brute forcing of weak Remote Desktop Protocol (RDP) credentials. The campaign reflects a broader move toward targeted ransomware intrusions that rely on exposed remote access services rather than mass distribution alone.
Once launched, Matrix encrypts local files and network shares, deletes volume shadow copies, disables recovery options, and demands payment in Bitcoin. Operators use a variable ransom model in which victims are told to make contact and provide sample files for decryption so the attackers can assess payment demands; known variants use multiple file extensions, including the Fox strain that appends .FOX to encrypted files.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
By 2018, Matrix's primary attack vector had shifted from earlier methods such as spam, malicious Windows shortcuts, and the RIG exploit kit to brute forcing weak Remote Desktop Protocol credentials. The report says this mirrored trends seen in other targeted ransomware operations.
Matrix was first publicly identified as a ransomware family in December 2016. The family primarily targeted small- to medium-sized organizations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Maze** ransomware operation evolved from earlier exploit-kit activity associated with “ChaCha ransomware” into a prominent double-extortion threat that stole data before encrypting systems and then pressured victims by publishing stolen files on dedicated leak sites. Operators built a public reputation around naming victims, courting media attention, and using data exposure as leverage to increase the likelihood of ransom payments. Maze infections were delivered through multiple channels, including spam campaigns impersonating government tax agencies and later more targeted compromises through **Remote Desktop Protocol (RDP)** access and network exploitation. Sophos reported that the malware used heavy obfuscation, anti-analysis checks, persistence mechanisms, system and network reconnaissance, **HTTP POST** data exfiltration, and file encryption based on **RSA** and **ChaCha20**, while also showing selective behavior such as adjusting demands for home versus corporate systems and easing pressure in some medical-sector cases during COVID-19.
Jun 29, 2026
The operators behind **Mamba ransomware** resumed attacks against corporate networks, using the legitimate **DiskCryptor** utility to lock entire disks rather than just individual files. After gaining access to a victim environment, the attackers used **PsExec** to spread the malware across machines, then installed DiskCryptor components, a driver, and a malicious auto-start service before forcing a reboot. On the next stage, Mamba modified the **MBR bootloader**, encrypted disk partitions, and rebooted systems again to present a ransom note. Each infected machine received a unique DiskCryptor password passed to the dropper through command-line arguments, making recovery effectively impossible without the attacker-held key because DiskCryptor relies on strong encryption. The campaign follows the group’s earlier use of the malware in the San Francisco Municipal Transportation Agency incident, underscoring the continued threat posed by disk-encrypting ransomware in enterprise environments.
Aug 14, 2026
Security researchers reported that **Maze ransomware** was delivered through the **Spelevo exploit kit**, which abused `CVE-2018-15982`, a critical Adobe Flash Player flaw, to execute code and install the payload. Once launched, Maze encrypted files with **RSA** and **ChaCha20**, dropped the `DECRYPT-FILES.txt` ransom note, and directed victims to both Tor and clear-web payment portals that offered live chat and limited test decryption. Researchers also linked Maze to earlier delivery through the **Fallout exploit kit**, showing that the operators used multiple infection channels to spread the malware. Separate incident-response findings showed Maze operators evolving beyond simple encryption into **targeted intrusions** that paired ransomware with **data theft and extortion**. Cisco Talos observed attackers using **Cobalt Strike** after initial access, moving laterally for at least a week, logging in interactively over **RDP**, executing remote PowerShell through **WMIC**, compressing stolen data with **7-Zip**, and exfiltrating it via PowerShell to a remote FTP server before deploying the ransomware. The activity reflected a broader shift in ransomware operations toward stealing sensitive files first and then threatening public release to increase pressure on victims.
Aug 15, 2026