Makop
- First seen
- 2020-02-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-21 02:23:58
- Profile updated
- 2026-07-07 13:48:10
Targeted industries: healthcare-and-pharmaceutical manufacturing technology-and-telecommunications transportation-and-logistics
Context
Makop is a ransomware that encrypts the victim's files and demands a ransom for the decryption key. It typically targets various industries and uses the AES encryption algorithm to render data inaccessible until a ransom is paid.
Detection coverage
- 3 YARA rules
Detection rules
- TRELLIX_ARC_RANSOM_Makop (yara-rule)
- MALPEDIA_Win_Makop_Auto (yara-rule)
- MALPEDIA_Win_Makop_Ransomware_Auto (yara-rule)
Related threat objects
- DORRA (malware)
Reports & references
- ransomlook.io — Makop (report)
- Microsoft — What Tracking An Attacker Email Infrastructure Tells Us About Persistent Cybercriminal Operations (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Makop (report)
- blog.morphisec.com — The Fair Upgrade Variant Of Phobos Ransomware (report)
- medium.com — Makop The Toolkit Of A Criminal Gang 53Cd44563C11 (report)
- twitter.com — 1221797493849018368 (report)
- lifars.com — Makop Ransomware Whitepaper Case Studynew 1 (report)