Description
RansomEXX (a.k.a. Defray777) is a ransomware as a service group responsible for a large attack against the Brazilian Superior Court of Justice in 2020 and numerous other intrusions worldwide. Its tooling ships separate Windows and Linux encryptors, and its operators exfiltrate data before encryption and pressure victims through leak site publication. The family's cross platform support and high profile targets made it a fixture of big game hunting campaigns.
Stats
- First seen
- October 2022
- Last seen
- October 2026
Also known as
Ransomexx
Alert name variants
| Alert Name |
|---|
| Gen:Variant.Trojan.Linux.RansomEXX.1 |
| Linux.Ransomware.Ransomexx |
| Linux.Ransomware.RansomEXX |
| Linux.Trojan.Ransomexx |
| Linux.Trojan.RansomEXX |
| Trojan.Linux.Ransom.RansomEXX.1 |
| Trojan.Linux.Ransom.RansomEXX.2 |
| Trojan.Linux.Ransom.RansomEXX.4 |
| Trojan.Linux.RansomEXX.A |
| Trojan.Linux.RansomEXX.B |