RansomEXX (ELF)
Aliases: Defray777
- First seen
- 2020-11-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:58:11
Targeted industries: government-and-public-sector manufacturing transportation-and-logistics
Targeted regions: country_code:us country_code:fr
Context
According to SentineOne, RansomEXX (aka Defray, Defray777), a multi-pronged extortion threat, has been observed in the wild since late 2020. RansomEXX is associated with attacks against the Texas Department of Transportation, Groupe Atlantic, and several other large enterprises. There are Windows and Linux variants of this malware family, and they are known for their limited and exclusive targeting.
Reports & references
- CrowdStrike — Report2021Gtr (report)
- intezer.com — Top Linux Cloud Threats Of 2020 (report)
- CrowdStrike — Carbon Spider Sprite Spider Target Esxi Servers With Ransomware (report)
- youtube.com — Watch (report)
- blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
- vmware.com — Vmw Exposing Malware In Linux Based Multi Cloud Environments (report)
- cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
- krebsonsecurity.com — Ransomware Gangs And The Name Game Distraction (report)
- web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- CrowdStrike — Carbon Spider Sprite Spider Target Esxi Servers With Ransomware (report)
- paloaltonetworks.com — Unit42 Ransomware Threat Report 2021 (report)
- ic3.gov — 211101 (report)
- Kaspersky — 99279 (report)
- cybereason.com — Cybereason Vs. Ransomexx Ransomware (report)
- gustavopalazolo.medium.com — Ransomexx An%C3%A1Lise Do Ransomware Utilizado No Ataque Ao Stj 918001Ec8195 (report)
- bleepingcomputer.com — Ecuadors State Run Cnt Telco Hit By Ransomexx Ransomware (report)
- ctir.gov.br — Alerta 2020 03 Ataques De Ransomware (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Ransomexx (report)
- sentinelone.com — Ransomexx (report)
- securityintelligence.com — Ransomexx Upgrades Rust (report)