MalwarePublished 16 Jul 2025Updated 28 Jul 2025

Analysis of Secp0 Ransomware

Source AlienVault OTX General

Description

Secp0 is a ransomware that emerged in early 2025, initially mischaracterized as a vulnerability disclosure extortion group. It operates as a conventional double-extortion ransomware, encrypting data while threatening public disclosure. The malware is an ELF binary targeting Linux systems, using ChaCha20 encryption with ECDH key exchange. It features configurable command-line options and embedded encrypted data. The encryption process involves generating session and file key pairs, calculating shared keys, and appending necessary decryption information to files. The ransomware's structure prevents decryption without the attacker's cooperation, making recovery challenging.

Impact

For European organizations, Secp0 ransomware poses a substantial risk, particularly to sectors heavily reliant on Linux-based servers and infrastructure such as finance, telecommunications, manufacturing, and public administration. The double-extortion approach not only threatens data confidentiality through encryption but also risks public exposure of sensitive or regulated data, potentially leading to reputational damage, regulatory fines under GDPR, and operational disruption. The inability to decrypt files without the attacker’s cooperation means that organizations face difficult decisions regarding ransom payment or costly recovery efforts. Given the ransomware’s targeting of Linux systems, organizations using Linux for critical services, cloud environments, or containerized applications are especially vulnerable. The threat also complicates incident response due to the advanced cryptographic methods employed, which prevent straightforward decryption or key recovery. Additionally, the presence of multiple onion domains and support sites suggests an organized ransomware operation capable of sustained campaigns, increasing the likelihood of targeted attacks against high-value European entities. The medium severity rating reflects the ransomware’s technical sophistication and impact potential, though the absence of widespread exploitation currently limits immediate large-scale impact.

Defensive guidance

European organizations should implement targeted mitigation strategies beyond generic ransomware advice. First, enforce strict access controls and multi-factor authentication on Linux systems to prevent unauthorized access, as initial compromise vectors may involve credential theft or exploitation of weak authentication (T1078). Regularly audit and monitor command-line activities and process executions to detect anomalous behaviors indicative of ransomware deployment (T1059.004). Employ file integrity monitoring to identify unauthorized file modifications or encryption attempts early. Backup strategies must include immutable, offline, or air-gapped backups to ensure recovery without ransom payment, with frequent testing of restoration processes. Network segmentation should isolate critical Linux servers to limit lateral movement. Deploy endpoint detection and response (EDR) solutions capable of recognizing Linux ransomware behaviors and indicators such as the specific YARA signatures and hashes associated with Secp0. Monitor network traffic for connections to known malicious onion and C2 domains listed in the indicators to detect and block ransomware communications. Additionally, implement strict patch management and vulnerability scanning to reduce attack surface, even though no specific exploits are known yet. Incident response plans should include procedures for double-extortion scenarios, including legal and communication strategies for potential data leaks. Finally, employee training on phishing and social engineering remains essential, as initial infection vectors often involve user interaction.

Indicators of compromise

Domains 5

2a6w667vebiebciji7vm3vj43svegvozoqypttdgojzgdcbnfsu5wiid.onion
bhn2xz5jer2xeibxjzhgfp7qclttnbvkkvd4hvlmjbnz66jxq7yzn6ad.onion
secp0-support.cfd
secp0-support.net
secponewsxgrlnirowclps2kllzaotaf5w2bsvktdnz4qhjr2jnwvvyd.onion

Hashes 1

bbcf4469a0a849ec3c65bbf2ad188896f8d222b7f4e6e5b1c85747ae3ad95818

Yara 1

9f013715e7f27acfba258cda085f11a1395243f1

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Jul 2025, 08:31 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

Domains 5

Hashes 1

Yara 1

Community reviews

Related threats