Loading story…
Researchers identified FuxSocy Encryptor as a ransomware family that closely imitates the defunct Cerber strain in both presentation and parts of its internal logic. The malware encrypts victim files with AES, scrambles or renames filenames in Cerber-like patterns, drops ransom notes such as ***__READ___THIS__***.txt, and can change the desktop wallpaper after locking data. Analysis found it skips or prioritizes certain folders, includes anti-virtual-machine checks, and in some variants partially encrypts files beginning at offset 0x708, a technique that still leaves many documents unusable.
The operators initially directed victims to make contact through qTox/ToxChat rather than a Tor payment portal, later shifting some variants to email addresses including king-size_banana@thesecure.biz and fuxsocy@cockl.li. Reporting on later samples shows the family remained active in subsequent years with variants using extensions such as .b58d, while likely relying on common intrusion routes including exposed RDP, phishing emails, malicious attachments, fake downloads, exploits, malvertising, and trojanized installers. No free decryptor was available in the early reporting, and victims were advised to recover from backups instead of paying the ransom.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
The ID Ransomware write-up says a January 4, 2023 FuxSocy variant used the ransom note name ***__READ___THIS__***.txt and the contact email king-size_banana@thesecure.biz. It also provides the SHA-256 hash of a sample from that variant.
An update in the ID Ransomware write-up documents a December 22, 2019 variant that appends the .b58d extension to encrypted files. The same update gives example encrypted and ransom-note filenames for that variant.
Michael Gillespie reported that FuxSocy begins encrypting files at offset 0x708 instead of encrypting entire files. The analysis noted this still rendered many documents unusable, though some images retained visible unencrypted regions.
Reverse engineering by Vitali Kremez found that FuxSocy borrowed Cerber's skipped-path logic, filename scrambling behavior, and similar wallpaper styling, while adding broader anti-VM checks. Reporting also noted that victims were directed to contact the operators through Tox/qTox rather than a Tor payment site.
BleepingComputer reports that MalwareHunterTeam discovered the FuxSocy ransomware in October 2019. Researchers found it closely imitated the defunct Cerber ransomware in appearance and parts of its internal logic.
The ID Ransomware write-up states that FuxSocy Encryptor activity was first noted in early October 2019. It describes the family as encrypting files and demanding payment for recovery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Cyrat**, a Python-based ransomware strain that masqueraded as a DLL repair tool and primarily targeted English-speaking users while remaining capable of wider global spread. After execution, the malware encrypted files in common user directories, appended the `.CYRAT` extension, and dropped `RANSOME_NOTE.txt` ransom notes demanding **$1,000 in Bitcoin**, with a reduced **$500** payment offer if victims paid within two days. Technical analysis found that Cyrat used **Fernet** symmetric encryption via **PyCryptodome** to encrypt entire files, then protected the Fernet key with an **RSA public key** downloaded from **MediaFire** rather than embedding it in the sample. The encrypted key was stored in `EMAIL_US.txt` for victims to send back to the attackers, and the malware also downloaded an image, saved it as `background_img.png`, and changed the desktop wallpaper to draw attention. Researchers noted Cyrat had relatively low prevalence and contained coding flaws, including extension-matching issues and a reported `Pyfiglet`-related crash that could disrupt encryption.
Aug 15, 2026
**AnteFrigus** is a low-prevalence crypto-ransomware family that encrypts victim files with **AES**, appends random file extensions, and drops a ransom note as a randomly named `-readme.txt` file. The malware has primarily targeted English-speaking users but can affect victims globally, and observed samples avoided encrypting the `C:` drive while locking files on removable media and mapped network drives such as `D:` through `I:`. Victims were directed to pay through a **Tor** portal or contact `antefrigus@cock.li`, with ransom demands starting at **$1,995** and rising to **$3,990** after four days. Researchers linked AnteFrigus to the **Prometey** ransomware line and reported distribution through the **HookAds** malvertising campaign redirecting users to the **RIG exploit kit**, alongside possible delivery via exposed **RDP**, spam, malicious attachments, fake updates, botnets, and repacked installers. The malware reportedly used **iplogger.org** to identify the infected host’s IP address and skipped encrypting selected executable and system-related file types. Later variants adopted extensions including `.eaaeee`, `.bbadc`, `.aceadf`, `.daaefc`, and `.feeef`, and shifted to new ransom note names and payment sites such as `recovery-help.top` and `restore-now.top`.
Aug 15, 2026
Researchers reported that **Fog ransomware** is being deployed through a heavily obfuscated, multi-stage loader designed to frustrate analysis and bypass defenses. The initial loader uses large amounts of junk code, anti-sandbox and anti-debugging checks, and DLL unhooking before decrypting a second-stage shellcode that resolves APIs through hashing, reflectively loads an embedded DLL, and triggers its `DLLRegisterServer` export to launch the ransomware payload. Trend Micro also linked Fog activity to criminals claiming ties to **DOGE**, indicating an effort to brand or disguise the operation while expanding distribution. The final Fog payload decrypts an internal JSON configuration and ransom note, creates a mutex, performs host reconnaissance, and attempts to stop selected processes and services before deleting shadow copies and encrypting files with a multithreaded routine. The ransom note says victims' data was both encrypted and exfiltrated, and it directs targets to **Tor-based** contact infrastructure, underscoring Fog's use of double-extortion tactics alongside layered evasion and execution techniques.
Aug 15, 2026