Threats Tagged 'underground ransomware'
View all threats tagged with 'underground ransomware'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'underground ransomware'
Click on any threat for detailed analysis and mitigation recommendations
The Underground ransomware gang is conducting global attacks against companies across various countries and industries. First identified in July 2023, the group resurfaced in May 2024 with a new Dedicated Leak Site. Their targets include multinational corporations from diverse sectors, with annual revenues ranging from $20 million to $650 million. The ransomware uses a combination of RNG, AES, and RSA encryption techniques, with each file encrypted using a different AES key. The malware is designed to leave insufficient traces for decryption in the local environment. It categorizes files based on size and employs a striping method for larger files. The ransomware also deletes shadow copies, restricts remote desktop connections, and stops interfering services before encryption. Join the discussion | AlienVault OTX General | 08/27/2025, 16:22:15 UTC Added: 08/27/2025, 19:32:50 UTC |
Showing 1 to 1 of 1 result