RATs, ransomware & infostealers
Curated profiles for well-known, well-documented malware families, cross-referenced against every detection rule Sigma Watch tracks. Each profile links out to authoritative sources — MITRE ATT&CK, CISA advisories, and vendor threat-intel writeups — for eradication and remediation guidance, rather than us writing our own removal steps that could go stale or be wrong.
ALPHV/BlackCat
ALPHV/BlackCat was a Rust-based RaaS operation active from November 2021, notable for double extortion attacks including the February 2024 Change Healthcare bre…
Agrius
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1030) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Akira
Akira is a RaaS operation active since March 2023 that conducts double extortion using Windows, Linux, and VMware ESXi encryptors, frequently exploiting VPN/edg…
Akira _v2
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1194) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Apostle
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1133) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Avaddon
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0640) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
AvosLocker
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1053) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Babuk
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0638) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Bad Rabbit
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0606) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Bazar
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0534) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
BitPaymer
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0570) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Black Basta
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1070) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
BlackByte
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1043) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
BlackByte 2.0 Ransomware
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1181) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
BlackByte Ransomware
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1180) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Bumblebee
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1039) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
CHIMNEYSWEEP
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1149) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Cheerscrypt
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1096) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Cinnamon Tempest
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1021) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Cl0p
Cl0p (Clop) is an extortion group linked to the TA505/FIN11 threat cluster, known since 2019 for mass-exploiting file-transfer and enterprise-software vulnerabi…
Conti
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0575) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Cuba
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0625) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
DCSrv
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1033) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
DEATHRANSOM
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0616) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
DarkGate
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1111) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Diavol
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0659) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
EKANS
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0605) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
EXOTIC LILY
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1011) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Egregor
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0554) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Embargo
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1247) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
FIN7
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G0046) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
FIN8
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G0061) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
FIVEHANDS
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0618) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
GOLD SOUTHFIELD
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G0115) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
GrimAgent
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0632) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
HELLOKITTY
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0617) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
HUI Loader
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1097) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
INC Ransom
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1032) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
INC Ransomware
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1139) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
IPsec Helper
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1132) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Indrik Spider
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G0119) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
JCry
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0389) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
KillDisk
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0607) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
LAPSUS$
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1004) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
LockBit
LockBit is a Ransomware-as-a-Service (RaaS) operation active since 2019 that became the most prolific ransomware brand of 2022-2023, using double extortion (dat…
LockBit 2.0
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1199) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
LockerGoga
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0372) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Maze
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0449) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Medusa Group
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1051) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Medusa Ransomware
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1244) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
MegaCortex
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0576) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Megazord
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1191) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Moneybird
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1137) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Mustard Tempest
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1020) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Netwalker
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0457) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
NotPetya
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0368) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Pay2Key
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0556) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Pikabot
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1145) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Play
Play (deploying the Playcrypt encryptor) is a closed, non-advertised ransomware operation active since June 2022 that uses double extortion and intermittent enc…
Prestige
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1058) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
ProLock
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0654) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Pysa
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0583) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
QakBot
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0650) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Qilin
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1242) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
REvil
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0496) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
ROADSWEEP
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1150) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Ragnar Locker
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0481) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
RansomHub
RansomHub was a RaaS operation that emerged in February 2024, built on source code derived from the Knight ransomware (itself a rebrand of Cyclops), and rapidly…
Raspberry Robin
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1130) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Rclone
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1040) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
RobbinHood
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0400) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Royal
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1073) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Rubeus
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1071) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Ryuk
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0446) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
SMOKEDHAM
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0649) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
SamSam
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0370) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Scattered Spider
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1015) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Seth-Locker
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0639) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
SocGholish
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1124) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
SombRAT
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0615) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
StealBit
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S1200) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Storm-0501
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1053) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Storm-1811
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1046) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
SynAck
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0242) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
SystemBC
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S9001) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
TeamPCP
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1056) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
ThiefQuest
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0595) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
TrickBot
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0266) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
WannaCry
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0366) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
WastedLocker
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0612) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Water Galura
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G1050) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
WhisperGate
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0689) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Wizard Spider
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (G0102) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …
Xbash
Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0341) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's …