RansomEXX

Aliases: Ransom X, Defray777, Defray-777, Defray 2018

Malware type
ransomware, trojan
Family
Malware family
Profile updated
2026-07-07 12:58:24

Targeted industries: government-and-public-sector healthcare-and-pharmaceutical manufacturing technology-and-telecommunications

Context

We recently discovered a new file-encrypting Trojan built as an ELF executable and intended to encrypt data on machines controlled by Linux-based operating systems. After the initial analysis we noticed similarities in the code of the Trojan, the text of the ransom notes and the general approach to extortion, which suggested that we had in fact encountered a Linux build of the previously known ransomware family RansomEXX. This malware is notorious for attacking large organizations and was most active earlier this year. RansomEXX is a highly targeted Trojan. Each sample of the malware contains a hardcoded name of the victim organization. Moreover, both the encrypted file extension and the email address for contacting the extortionists make use of the victim’s name.

Detection coverage

  • 3 YARA rules

Detection rules

  • DITEKSHEN_MALWARE_Win_Ransomexx (yara-rule)
  • DITEKSHEN_MALWARE_Linux_Ransomexx (yara-rule)
  • MALPEDIA_Win_Ransomexx_Auto (yara-rule)

Reports & references

  • CrowdStrike — Report2021Gtr (report)
  • intezer.com — Top Linux Cloud Threats Of 2020 (report)
  • CrowdStrike — Carbon Spider Sprite Spider Target Esxi Servers With Ransomware (report)
  • youtube.com — Watch (report)
  • Microsoft — Exploitation Of Clfs Zero Day Leads To Ransomware Activity (report)
  • blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
  • vmware.com — Vmw Exposing Malware In Linux Based Multi Cloud Environments (report)
  • cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
  • docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
  • krebsonsecurity.com — Ransomware Gangs And The Name Game Distraction (report)
  • web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
  • cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
  • CrowdStrike — Carbon Spider Sprite Spider Target Esxi Servers With Ransomware (report)
  • cyborgsecurity.com — Hunting Ransomware Inhibiting System Backup Or Recovery (report)
  • paloaltonetworks.com — Unit42 Ransomware Threat Report 2021 (report)
  • Cisco Talos — Quarterly Ir Report Fall 2020 Q4 (report)
  • bleepingcomputer.com — Ransomware Attack Hits Italys Lazio Region Affects Covid 19 Site (report)
  • ic3.gov — 211101 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Ransomexx (report)
  • id-ransomware.blogspot.com — Ransomexx Ransomware (report)
  • github.com — Ransom.Exx (report)
  • bleepingcomputer.com — New Ransom X Ransomware Used In Texas Txdot Cyberattack (report)
  • bleepingcomputer.com — Brazils Court System Under Massive Ransomexx Ransomware Attack (report)
  • Palo Alto Unit 42 — 4 (report)
  • Kaspersky — 99279 (report)

External references