HiddenTear
Aliases: Cryptear, EDA2, Hidden Tear, FuckUnicorn
- First seen
- 2015-08-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-22 02:01:27
- Profile updated
- 2026-07-07 15:42:35
Context
HiddenTear is an open-source ransomware written in C#. Initially released as a proof of concept for educational purposes, it has been weaponized by various threat actors to conduct real-world attacks.
Detection coverage
- 1 YARA rules
Detection rules
- DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ryzerlo (yara-rule)
Related threat objects
- EDA2 (malware)
Reports & references
- utkusen.com — Dealing With Script Kiddies Cryptear B Incident (report)
- id-ransomware.blogspot.com — Hiddentear 2 (report)
- CrowdStrike — Carbon Spider Embraces Big Game Hunting Part 2 (report)
- bleepingcomputer.com — Hidden Tear Ransomware Developer Blackmailed By Malware Developers Using His Code (report)
- utkusen.com — Im Sorry For Hidden Tear Eda2 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Hiddentear (report)
- linkedin.com — Threatmon Azzasec Ransomware Technical Malware Analysis Ugcpost 7223910683967393792 Ezaa (report)
- slideshare.net — Open Source Malware Sharing Is Caring (report)
- github.com — Hidden Tear (report)
- twitter.com — 1264828072001495041 (report)
- twitter.com — 950787783353884672 (report)
- bleepingcomputer.com — New F Unicorn Ransomware Hits Italy Via Fake Covid 19 Infection Map (report)
- dissectingmalwa.re — Earn Quick Btc With Hiddentearmp4 About Open Source Ransomware (report)
- tripwire.com — Hidden Tear Project Forbidden Fruit Is The Sweetest (report)