Loading story…
Rhino ransomware, also tracked as Marvel, was identified as a business-targeting crypto-ransomware family that encrypted files using AES+RSA and demanded Bitcoin for decryption. Reporting says the malware emerged in early 2020, primarily hit English-speaking victims, and appended extensions such as .[generalchin@countermail.com].rhino to locked files. Its ransom notes were delivered through files including info.hta, Decryptor_Info.hta, and ReadMe_Decryptor.txt, while a sample later analyzed by VMRay had reportedly been found by security researcher @GrujaRS.
Technical reporting links Rhino/Marvel to the broader DCRTR ransomware lineage and says the family evolved into multiple later variants and aliases, including Parrot, Coka, and Termit, each using different extensions and contact addresses. Analysts documented behavior consistent with enterprise-focused ransomware, including stopping security and server-related services, deleting shadow copies, disabling recovery features, establishing persistence through Run registry keys, and using mutexes such as Marvel and Marvel01.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
An October 2020 variant of the Rhino/Marvel family used the extension .[ashtray@outlookpro.net].termit and contact addresses including ashtray@outlookpro.net. The activity was accompanied by the hacking tool NetTool.Scan, also called Network Scanner.
A June 2020 variant of the Rhino/Marvel family used the extension .[servicemanager@yahooweb.co].coka and multiple contact addresses including servicemanager@yahooweb.co. The variant reportedly used the file marker Marvel101.
Rhino ransomware, also referred to as Marvel, was first identified in April 2020. The family was described as active around early April 2020 and targeting business environments.
A Rhino ransomware sample analyzed by VMRay was reportedly found by Twitter user @GrujaRS on May 4th. The source does not specify the year for that date.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Tycoon**, also tracked as **RedRum**, **Grinch**, and in some reporting alongside **Thanos**-linked variants, emerged as a manually deployed ransomware threat against enterprise environments on both **Windows** and **Linux**. Operators were reported to gain access through vulnerable or exposed **RDP** services, then encrypt files with **AES-256-GCM** while protecting encryption keys with **RSA-1024**. The malware appended extensions including `.redrum`, `.grinch`, `.thanos`, `.eruption`, and `.magneto`, and dropped a ransom note named `decryption.txt` using contact addresses such as `moncler@tutamail.com` and `moncler@cock.li`. Reporting also tied the activity to broader **Thanos** ransomware development, a .NET-based **RaaS** ecosystem that enabled extensive customization, persistence, anti-analysis, and defense-evasion features across multiple later variants. The malware was described as deleting shadow copies and disabling recovery and firewall protections while avoiding some system files and directories to keep infected systems operational. Historical tracking indicates some early Hakbit-identified and RedRum samples could be decrypted, including with an **Emsisoft** decryptor, while later corrected Thanos-derived variants adopted stronger RSA-based encryption that generally prevented recovery without the attackers' private key.
Aug 14, 2026
Prometheus emerged as a **Thanos-based ransomware** operation targeting organizations with file encryption, victim-specific extensions, and ransom notes such as `RESTORE_FILES_INFO.txt` and `.hta` variants, while also threatening to leak stolen data through a dedicated extortion site and negotiation portal. Researchers said the group claimed ties to **REvil**, but multiple analyses found no technical evidence to support that assertion, instead linking Prometheus to the leaked Thanos builder and a broader ransomware-as-a-service ecosystem. Reported demands ranged from **$6,000 to $100,000 in Monero**, and the malware was observed terminating backup and security processes, altering services, and disabling protections including **Raccine** to speed encryption and increase pressure on victims. A free **CyCraft decryptor** later offered partial recovery for some Prometheus-encrypted files by brute-forcing the malware's weak tickcount-derived **Salsa20** key generation, a flaw that made decryption feasible when known file structures or magic bytes were available. Its release was followed by the apparent shutdown of Prometheus infrastructure, but closely related **Thanos-derived** strains including **Haron, Spook, and Midas** continued to appear, reusing code, extortion tactics, leak sites, and technical markers such as shared note formats and encryption artifacts. Subsequent reporting tied these families to rebranding and builder reuse rather than a single clear attribution, showing how Prometheus became part of a wider lineage of ransomware operations targeting businesses across multiple sectors and countries.
Aug 15, 2026
A newly observed ransomware group called **Majinahanashi** has launched a double-extortion campaign against organizations primarily in non-English-speaking countries, claiming about 15 victims and concentrating on the **e-commerce** and **manufacturing** sectors. The operators run a Tor-based leak site and archive servers, publish victim previews and countdown timers, and use contact channels including **ProtonMail** and **qTox** while reportedly demanding at least **$15,000** in ransom. Reporting indicates the operation may involve at least two members and uses the slogan **"DECISION REQUIRES CLARITY."** The malware is a **Windows** ransomware family written in **C/C++** that appends the `.MAJIN` extension and encrypts files with **AES-256** using **RSA-wrapped per-file keys**. Analysis shows it can establish persistence through a Windows service, delete recovery artifacts, disable security tooling, and evade or hinder defenses through features such as lock-screen display, wallpaper hijacking, and network-control functions tied to the **Windows Filtering Platform**. Researchers also linked the activity to tools including **Mimikatz** and **Advanced IP Scanner**, underscoring a capable but still mid-tier ransomware operation with active leak-site maintenance.
Aug 18, 2026