Loading story…
Trend Micro reported that Povlsomware, an open-source proof-of-concept ransomware released as a defensive testing tool, includes features that could make it operationally useful to real attackers. The malware is designed to work with Cobalt Strike, allowing in-memory execution during post-exploitation activity, and it follows a conventional ransomware routine by checking for elevated privileges, attempting to remove backups through WMI, encrypting common file types, and then presenting a ransom note.
Researchers said Povlsomware’s most unusual characteristic is that it is extensionless: encrypted files keep their original names and appear normal in directory listings even though they can no longer be opened. While few real-world incidents had been observed at the time of reporting, Trend Micro warned that the project’s public availability, ransomware workflow, and compatibility with established offensive tooling could make it attractive to more experienced ransomware operators, and published detection names and multiple SHA-256 indicators tied to known samples.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Povlsomware, an open-source proof-of-concept ransomware described as a tool for testing ransomware defenses, was first released. Its later analysis noted that the project could be modified and reused by other actors.
Trend Micro analyzed Povlsomware's ransomware behavior, including its Cobalt Strike execute-assembly compatibility, in-memory execution, backup deletion attempts via WMI, and extensionless encryption. The report also published detection information and multiple SHA-256 indicators for Povlsomware samples.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that **DARKSIDE** operated as a ransomware-as-a-service group that combined data theft and file encryption, with affiliates conducting intrusions that moved from initial access to hands-on-keyboard post-exploitation before deploying ransomware. The group’s operations were associated with common enterprise attack tooling and tradecraft designed to blend into Windows environments, helping operators maintain access, move laterally, and prepare victim networks for extortion. The referenced techniques and detections show how that activity can appear on endpoints: adversaries may abuse trusted Microsoft utilities `Regsvcs` and `Regasm` under MITRE ATT&CK **`T1218.009`** to proxy malicious .NET code execution and evade application controls, while post-compromise activity may also surface through **Cobalt Strike** named pipes tied to Beacon, Artifact Kit, and Malleable C2 profiles. Splunk previously published analytics based on Sysmon Event IDs **17** and **18** to identify those pipe patterns, underscoring how defenders can spot the command-and-control and lateral movement behavior often seen in ransomware intrusions linked to groups such as DARKSIDE.
Aug 15, 2026
Trend Micro reported that the **Rapture** ransomware family was used in intrusions that likely began with exploitation of vulnerable public-facing web servers, with activity often originating from `w3wp.exe`. Operators carried out reconnaissance, deployed **Cobalt Strike** through PowerShell fetched from a command-and-control server, and abused `explorer.exe` with the `/NOUACCHECK` flag to gain elevated execution while keeping the intrusion chain relatively small and difficult to detect. Researchers said Rapture shares some traits with **Paradise** ransomware, including its RSA key configuration style and `.NET` execution requirements, but differs in behavior and only loosely resembles **Zeppelin** in its ransom note. The malware was commonly executed in memory instead of being written to disk, was packed with **Themida** to complicate analysis, and used hard-coded six-character strings in both ransom notes and encrypted filenames; observed attacks typically unfolded over **three to five days**.
Aug 15, 2026
A pro-Ukraine actor leaked **Conti Ransomware V3.0** source code, a compiled locker, and a decryptor, exposing the inner workings of one of the most active Russian-speaking ransomware operations. Researchers reviewing the leak said the code was functional and tied it to a broader stream of disclosures that also revealed Conti’s internal chats, tools, training materials, and administrative panels. Technical analysis of the leaked `conti_v3.sln` project showed API hashing and anti-hooking for evasion, multithreaded encryption, use of `CryptGenRandom`, RSA, and the **ChaCha** stream cipher, plus logic for full or partial encryption based on file type and size, including special handling for databases and virtual machine files. The leak gave defenders unusually detailed visibility into a group that had already evolved from **Ryuk**-linked operations and adopted double extortion through its **Conti.News** leak site, where stolen data was published to pressure victims. Separate reporting also documented active Conti affiliates using tools such as **Cobalt Strike** and **PsExec** against U.S. organizations, while independent researchers published unpacking work for Conti samples using FireEye’s **Speakeasy** emulation framework to dump unpacked payloads from memory and repair imports. Together, the disclosures increased defensive insight into Conti’s malware and operations, while also raising the risk that other threat actors could reuse the leaked code and techniques.
Aug 15, 2026