Loading story…
Researchers reported that a Brazil-focused XPan ransomware variant was still being deployed against victims through weakly protected RDP access, with attackers manually installing the malware after gaining entry. The sample appended the .one extension to encrypted files, used the contact address one@proxy.tg, and in at least one case demanded 0.3 bitcoin for recovery. Analysis linked the malware to other XPan/TeamXRat variants through source-code similarities, Brazilian Portuguese strings, and references to NMoreira.
The ransomware encrypted files with AES-256-CBC and stored an RSA-encrypted per-file secret at the start of each encrypted file, but researchers found the cryptographic implementation was flawed and could be reversed. They said the .one sample was nearly identical to a November 2016 XPan variant that used the .__AiraCropEncrypted! extension, differing mainly in its configuration block, and reported helping at least a driving school and a dentist clinic in Brazil recover files without paying the ransom.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers found the analyzed ".one" XPan sample was nearly identical to another XPan version distributed in November 2016, differing mainly in its configuration block. That earlier variant used the extension ".__AiraCropEncrypted!" on encrypted files.
The analyzed XPan ransomware sample and a closely related variant shared the same PE timestamp of October 31, 2016, indicating they were built from nearly identical code. Researchers described the analyzed sample as an early or foundational XPan variant.
Researchers determined that XPan's cryptographic implementation was flawed, allowing them to break the encryption and decrypt affected files. They said they helped at least a driving school and a dentist clinic in Brazil recover files without paying the ransom.
At least one victim reported that the attackers demanded 0.3 bitcoin in exchange for the recovery key. Victims were instructed to send their unique ID to the attackers' mailbox and wait for further instructions.
Securelist reported on an XPan ransomware variant actively used against victims in Brazil, primarily after attackers gained access through weakly protected RDP and manually deployed the malware. The variant appended the ".one" extension, used the contact email "one@proxy.tg," and targeted small and medium businesses.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers in Colombia and Mexico encrypted victim systems by abusing **BitLocker**, turning native Microsoft functionality into a low-cost extortion tool instead of deploying custom ransomware. In the Colombia case, intruders accessed an internet-exposed **RDP** service, changed user credentials, encrypted a critical **8 TB** storage volume holding financial data, and demanded less than **$3,000**; the victim reportedly paid before forensic evidence could be preserved. Victims were alerted by locked drives, failed logins, and in some cases blue-screen messages reading **"Hacked by XEntry Team."** In the Mexico intrusion, attackers exploited a misconfigured internet-facing **Microsoft SQL Server** using leaked **MSSQL** credentials exposed in GitHub code, then abused `xp_cmdshell`, remote monitoring and management tools including **ManageEngine Endpoint Central**, **Mesh Agent**, and **Tactical RMM**, and **GPO**-based task deployment to spread BitLocker encryption across domain-connected systems. Ransom notes were printed directly from corporate office printers, and researchers said weak configuration management, exposed remote services, poor monitoring of endpoint protections, and misuse of legitimate administration tools enabled both incidents; similarities in ransom-note wording and delivery suggest the operations may be linked, with one case attributed to **XEntry Team**.
Jul 21, 2026
Attackers carried out two extortion intrusions in Latin America by abusing exposed Microsoft services and legitimate administration tools rather than deploying conventional ransomware. In one case in Colombia, a threat actor accessed an internet-facing `RDP` service, seized control of a system connected to an 8 TB storage device, encrypted the financial-data drive with **BitLocker**, and printed ransom notes demanding **$3,000**. In another case in Mexico, the group identified as **XEntry Team** exploited a misconfigured internet-facing **Microsoft SQL Server** with `xp_cmdshell` enabled after obtaining database credentials from code exposed on GitHub. After gaining access in Mexico, the attackers expanded through the environment by weakening web server security settings, deploying web shells, and installing remote management tools including **ManageEngine Endpoint Central**, **Mesh Agent**, and **Tactical RMM** for persistence and command execution. They then used **Group Policy Objects** and scheduled tasks to enable **BitLocker** and encrypt disks across the domain, while victims reported blue screens reading **"Hacked by XEntry Team,"** failed credentials, locked drives, and ransom notes printed from corporate printers. The incidents highlighted how exposed services, poor credential hygiene, weak alert handling, and ineffective endpoint protection can turn built-in Windows functionality into an enterprise-wide extortion mechanism.
Jul 21, 2026
Researchers found an open directory and management panel tied to the **CRPX0** malware operation at `fanonlyatn[.]xyz`, exposing the full source code, backend infrastructure, and operator details for a malware-as-a-service platform. The leaked materials showed a three-part criminal toolkit: a cryptocurrency clipboard hijacker supporting 10 coins, a **BIP39** seed-phrase scanner and stealer, and ransomware for **Windows, macOS, and Linux** that appends the `.crpx0` extension. The code and panel also exposed plaintext secrets, including a shared dashboard API secret, a loader password, ten hardcoded wallet addresses, and contact points linked to the operator, including the Telegram handle **@DataBreachPlus**, `databreachplus@proton[.]me`, and a qTox ID. Analysis of the leaked infrastructure tied the operation to backup command-and-control and ransom-notification domains hosted on `31[.]31[.]198[.]206` through **REG.RU**, while the primary panel sat behind Cloudflare. The exposed files showed Windows routines to delete Volume Shadow Copies, macOS builder scripts aimed at bypassing Gatekeeper, and lures themed around fake **FedEx** shipping notices and fake **OnlyFans** account lists. Researchers also identified a separate exposed **TwizAdmin** panel at `103.241.66[.]238:1337` that pointed to additional infostealer functionality and suggested the campaign has been active since at least July 2025; one unusual artifact was ransomware wallpaper containing **C2PA** metadata indicating it had been generated with **ChatGPT/GPT-4**.
Jun 29, 2026