MegaCortex

Description

MegaCortex is a ransomware family that targeted corporate networks starting in 2019, often reaching victims after infections with QakBot or TrickBot. It killed processes and security services before encrypting files, and its operators demanded large payments from enterprise victims while using leak site pressure.

Stats

First seen: February 2022
Last seen: October 2026

Also known as

Megacortex

MITRE ATT&CK techniques

16 techniques across 6 tactics.

TA0042 Resource Development

T1588Obtain Capabilities
- T1588.003Code Signing Certificates

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0005 Stealth

T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1134Access Token Manipulation
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.011Rundll32
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks

TA0007 Discovery

T1083File and Directory Discovery

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1531Account Access Removal
T1561Disk Wipe
- T1561.001Disk Content Wipe

TA0112 Defense Impairment

T1112Modify Registry
T1685Disable or Modify Tools

Alert name variants

Alert Name	Engine
Gen:Variant.Ransom.Megacortex.1	AV
Gen:Variant.Ransom.Megacortex.3	AV
Trojan.Ransom.MegaCortex.B	AV
Win32.Ransomware.MegaCortex	ATP Sandbox Adv. Heuristics
Win32.Trojan.MegaCortex	ATP Sandbox Adv. Heuristics