RansomEXX

Aliases: Ransom X, Defray777, Defray-777, Defray 2018

Malware type
ransomware, trojan
Family
Malware family
Related IoCs
4
Last IoC activity
2026-10-16 16:53:35
Profile updated
2026-07-07 12:58:24

Targeted industries: government-and-public-sector healthcare-and-pharmaceutical manufacturing technology-and-telecommunications

Context

We recently discovered a new file-encrypting Trojan built as an ELF executable and intended to encrypt data on machines controlled by Linux-based operating systems. After the initial analysis we noticed similarities in the code of the Trojan, the text of the ransom notes and the general approach to extortion, which suggested that we had in fact encountered a Linux build of the previously known ransomware family RansomEXX. This malware is notorious for attacking large organizations and was most active earlier this year. RansomEXX is a highly targeted Trojan. Each sample of the malware contains a hardcoded name of the victim organization. Moreover, both the encrypted file extension and the email address for contacting the extortionists make use of the victim’s name.

Detection coverage

  • 3 YARA rules

Detection rules

  • MALPEDIA_Win_Ransomexx_Auto (yara-rule)
  • DITEKSHEN_MALWARE_Win_Ransomexx (yara-rule)
  • DITEKSHEN_MALWARE_Linux_Ransomexx (yara-rule)

Reports & references

  • malpedia.caad.fkie.fraunhofer.de — Win.Ransomexx (report)
  • id-ransomware.blogspot.com — Ransomexx Ransomware (report)
  • github.com — Ransom.Exx (report)
  • bleepingcomputer.com — New Ransom X Ransomware Used In Texas Txdot Cyberattack (report)
  • bleepingcomputer.com — Brazils Court System Under Massive Ransomexx Ransomware Attack (report)
  • Palo Alto Unit 42 — 4 (report)
  • Kaspersky — 99279 (report)
  • bleepingcomputer.com — Computer Hardware Giant Gigabyte Hit By Ransomexx Ransomware (report)
  • cybereason.com — Cybereason Vs. Ransomexx Ransomware (report)
  • infosecurity-magazine.com — Aerospace Giant Embraer Hit (report)
  • gustavopalazolo.medium.com — Ransomexx An%C3%A1Lise Do Ransomware Utilizado No Ataque Ao Stj 918001Ec8195 (report)
  • bleepingcomputer.com — Ecuadors State Run Cnt Telco Hit By Ransomexx Ransomware (report)
  • ctir.gov.br — Alerta 2020 03 Ataques De Ransomware (report)
  • medium.com — Ransomexx Fixing Corrupted Ransom 8E379Bcaf701 (report)
  • Palo Alto Unit 42 — Vatet Pyxie Defray777 (report)
  • Palo Alto Unit 42 — 3 (report)
  • Palo Alto Unit 42 — 5 (report)
  • Trend Micro — Expanding Range And Improving Speed A Ransomexx Approach (report)
  • Trend Micro — Ransomware Spotlight Ransomexx (report)
  • ransomlook.io — Ransomexx (report)
  • ic3.gov — 211101 (report)
  • CrowdStrike — Carbon Spider Sprite Spider Target Esxi Servers With Ransomware (report)
  • youtube.com — Watch (report)
  • intezer.com — Top Linux Cloud Threats Of 2020 (report)
  • CrowdStrike — Report2021Gtr (report)

External references