Rhino Ransomware Targeted Businesses With AES-RSA Encryption and DCRTR Variants

Rhino ransomware, also tracked as Marvel, was identified as a business-targeting crypto-ransomware family that encrypted files using AES+RSA and demanded Bitcoin for decryption. Reporting says the malware emerged in early 2020, primarily hit English-speaking victims, and appended extensions such as .[generalchin@countermail.com].rhino to locked files. Its ransom notes were delivered through files including info.hta, Decryptor_Info.hta, and ReadMe_Decryptor.txt, while a sample later analyzed by VMRay had reportedly been found by security researcher @GrujaRS.

Technical reporting links Rhino/Marvel to the broader DCRTR ransomware lineage and says the family evolved into multiple later variants and aliases, including Parrot, Coka, and Termit, each using different extensions and contact addresses. Analysts documented behavior consistent with enterprise-focused ransomware, including stopping security and server-related services, deleting shadow copies, disabling recovery features, establishing persistence through Run registry keys, and using mutexes such as Marvel and Marvel01.