Ransomware - RansomExx

RansomExx is a Human-Operated Ransomware (HumOR) that has existed since May 2020. However, the group associated with it - Sprite Spider - has been deploying ancestors of this ransomware known as Defray and Defray777. The Defray group has been around since 2017, and it's known to have created other malware, such as Vatet and PyXie, to aid their ransomware efforts. So, this group has an extensive history, relatively speaking, of successfully exploiting organizations worldwide with their ransomware. The group also exports its victims on the dark web data leak site, a tactic called "double extortion," and has listed large organizations such as the Texas government, Gigabyte, Hellman Worldwide Logistics, and Ferrari, just to name a few.

In December 2022, a variant of RansomExx was discovered using the Rust programming language. At the same time, the group renamed its website RansomExx2. As such, we created a variant called RansomExx2, named after the new website coupled with the new Rust implementation. Although, the behavior of the new variant is similar to the original. Any victims posted since the rename are tied to that entry as well. You can view them here: RansomExx2.