colossus
- First seen
- 2021-09-01 00:00:00
- Malware type
- ransomware
- Profile updated
- 2026-07-07 13:57:39
Targeted industries: transportation-and-logistics
Targeted regions: country_code:us
Context
Colossus ransomware was first observed in September 2021, when ZeroFox researchers uncovered the variant attacking a U.S.-based automotive group. It employs a double-extortion model, using Themida packing and sandbox evasion to disable defenses and deliver encrypted payloads. Victims are urged to visit a support site—hosted at a domain like colossus.support—to negotiate payment, or face large-scale data dumps and increasing ransom amounts tied to countdown timers. Operators demonstrated familiarity with RaaS playbooks, drawing architectural parallels to groups like EpsilonRed, BlackCocaine, and REvil/Sodinokibi.
Reports & references
- ransomlook.io — Colossus (report)
- zerofox.com — Flash Report Colossus Ransomware (report)
- securityweek.com — Colossus Ransomware Hits Automotive Company Us (report)
- superantispyware.com — What Is Colossus Ransomware (report)