0Mega
- First seen
- 2023-05-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:48:37
Targeted industries: technology-and-telecommunications retail-and-hospitality professional-services
Context
0mega, a new ransomware operation, has been observed targeting organizations around the world. The ransomware operators are launching double-extortion attacks and demanding millions of dollars as ransom. 0mega ransomware operation launched in May and has already claimed multiple victims. 0mega maintains a dedicated data leak site that the attackers use to post stolen data if the demanded ransom is not paid. The leak site currently hosts 152 GB of data stolen from an electronics repair firm in an attack that happened in May. However, an additional victim has since been removed, implying that they might have paid the ransom to the 0mega group. How does it work? Hackers add the .0mega extension to the encrypted file’s names and create ransom notes (DECRYPT-FILES[.]txt). The ransom note has a link to a Tor payment negotiation site with a support chat to reach out to the ransomware group. To log in to this site, the victims are asked to upload their ransom notes with a unique Base64-encoded blob identity.
Reports & references
- bleepingcomputer.com — New 0Mega Ransomware Targets Businesses In Double Extortion Attacks (report)
- cyware.com — New 0Mega Ransomware Joins The Double Extortion Threat Landscape 158Fb321 (report)
- ransomlook.io — 0Mega (report)