Loading story…
Sophos reported that two organizations hit by Entropy ransomware were first compromised through intrusions involving Dridex and remote-access tooling such as Cobalt Strike. One attack targeted a North American media company through ProxyShell exploitation and unfolded over roughly four months, while another began with a malicious email attachment sent to a regional government organization and escalated to data exfiltration in about 75 hours. In both cases, the attackers relied on widely available administrative and commercial tools for lateral movement, staging, and theft, including PsExec, PsKill, AdFind, WinRAR, ScreenConnect, and cloud storage services.
Reverse-engineering of the malware found notable similarities between Entropy and Dridex, including shared packer behavior, vectored exception handler setup, string decryption, and API resolution logic. Sophos said the overlap may indicate a development relationship and also noted packer detections previously tied to DoppelPaymer, adding to evidence that Entropy could belong to the ransomware lineage associated with Evil Corp. The findings underscore how unpatched internet-facing systems and weak authentication can enable long-running intrusions that end in ransomware deployment and data theft.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Reverse-engineering by Sophos found similarities between Entropy and Dridex in packer behavior, vectored exception handler setup, string decryption, and API resolution logic, suggesting a possible development relationship.
Sophos analyzed two separate ransomware incidents in which attackers deployed Entropy ransomware after intrusions involving remote-access tooling such as Cobalt Strike and Dridex.
After spending about four months inside the North American media organization probing the network and stealing data, the attackers launched the Entropy ransomware in early December.
About 75 hours after the initial suspicious login detection in the regional government incident, attackers began exfiltrating data after compressing files with WinRAR and uploading archives to privatlab.com, dropmefiles.com, and mega.nz.
In the second incident, a malicious email attachment infected a user's computer at a regional government organization with the Dridex botnet Trojan, which was then used to deliver additional malware and support lateral movement.
In one of the two incidents Sophos investigated, attackers exploited the ProxyShell vulnerability on a North American media organization's Exchange server, installed a remote shell, and used it to spread Cobalt Strike beacons internally.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators behind **REvil/Sodinokibi** and **DoppelPaymer** increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed **RDP** and **VPN** services, phishing-delivered malware such as **QAKBOT**, **Emotet**, and **Dridex**, brute force, and exploitation of internet-facing systems, then expanding control with tools including **Mimikatz**, **BloodHound**, **PsExec**, **WMI**, **Cobalt Strike**, and **Empire**. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks. REvil also helped normalize **double extortion** by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in **Mega.nz**. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Aug 15, 2026
The **REvil/Sodinokibi** ransomware operation broadened its playbook by combining network-wide encryption with data theft, public leak threats, and dark-web auctions of stolen files. The gang threatened to publish or sell data taken from victims including **GEDIA Automotive Group** and other unnamed companies, sometimes releasing samples such as an Active Directory **AdRecon** report or promising daily disclosures of employee and financial records. REvil also launched an auction site to monetize stolen data from non-paying victims, with opening bids such as **$50,000** in **Monero**, extending the pressure tactics already used in high-profile corporate extortion cases. Intrusions tied to REvil also showed increasingly targeted post-compromise activity. Symantec observed attackers using **Cobalt Strike**, PowerShell, remote access tools, and account creation to move laterally, disable defenses, and deploy ransomware, while also scanning some victim networks for **point-of-sale software** that could enable payment-card theft or prioritize systems for encryption. Reported victims included a New York airport, a New Jersey synagogue, and organizations in services, food, and healthcare, while Microsoft said human-operated ransomware crews were exploiting exposed **RDP**, vulnerable internet-facing systems, and flaws such as **`CVE-2019-19781`** and **`CVE-2019-11510`** before spending weeks or months inside networks prior to encryption.
Aug 15, 2026
**Dridex** emerged from the earlier **Cridex** banking malware lineage and developed into a long-running, modular botnet used to steal online banking credentials through web injection, redirection, and interception. Reporting ties the malware’s evolution to techniques associated with **GameOverZeuS**, with major changes over time in configuration formats, command-and-control communications, encryption, and botnet architecture, including peer-to-peer proxying and stronger loader authorization. The malware primarily targeted European victims, especially in the UK, Germany, and France, while using IP-based geo-filtering to avoid Russia. Open-source reporting and CERT-FR attribute Dridex’s development and operation to **Evil Corp**, describing an affiliate model in which separate operators managed botnet IDs, infection vectors, and regional targeting. Dridex was distributed through spam and phishing campaigns, ZIP-attached executables, exploit kits such as **Blackhole**, **Spelevo**, and **Fallout**, and secondary payload chains involving **Emotet**, **Gozi ISFB**, and **FakeUpdates**. Beyond banking theft, Dridex supported modules for **VNC** access, **SOCKS** proxying, credential theft, spam delivery, and email theft, and was later used for reconnaissance and follow-on ransomware deployment including **BitPaymer**, while related operators used **DoppelDridex** and **DoppelPaymer**; CERT-FR also published associated indicators of compromise for hunting and detection, while cautioning that infrastructure contact alone does not confirm compromise.
Aug 15, 2026