Buran
- First seen
- 2019-06-01 00:00:00
- Malware type
- ransomware, exploit-kit
- Family
- Malware family
- Last IoC activity
- 2026-07-18 01:17:20
- Profile updated
- 2026-07-07 13:45:28
Targeted industries: financial-services
Targeted regions: country_code:ru
Context
Buran is a new version of the Vega ransomware strain (a.k.a. Jamper, Ghost, Buhtrap) that attacked accountants from February through April 2019. The new Buran ransomware first was discovered by nao_sec in June 2019, delivered by the RIG Exploit Kit, as reported by BleepingComputer.
Detection coverage
- 3 YARA rules
Detection rules
- TRELLIX_ARC_Buran_Ransomware (yara-rule)
- ARKBIRD_SOLG_Ran_Buran_Oct_2020_1 (yara-rule)
- DITEKSHEN_MALWARE_Win_Buran (yara-rule)
Reports & references
- acronis.com — Meet Buran New Delphi Ransomware Delivered Rig Exploit Kit (report)