Ransomware Group
Ransomexx
RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.
Known victims86
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- LaZagne
- Mimikatz
- ProcDump
LOLBAS
- BCDEdit
- Windows Event Utility (wevtutil)
Offsec
- Cobalt Strike
Known infrastructure
The following Tor hidden services have been associated with this group:
RansomEXX v2
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Ransomexx’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request