Loading threat actor…
Bl00dy, also known as Bl00dy Ransomware Gang, is a ransomware-as-a-service operation that emerged in 2022 and is widely described as a spin-off or offshoot of the Russian-speaking Conti ecosystem. The group has been associated with use of leaked or reused ransomware builders, including tooling derived from LockBit, Babuk, and Conti, rather than exclusively bespoke malware development. Bl00dy has also been advertised on Russian-language cybercrime forums as a RaaS program. Bl00dy is known for financially motivated extortion operations involving both file encryption and theft of victim data. Reported victimology shows a particular focus on organizations in the United States, especially in the education and healthcare sectors. U.S. government reporting tied the group to exploitation of PaperCut MF/NG vulnerability CVE-2023-27350 for initial access, particularly against internet-exposed servers in the Education Facilities Subsector in early May 2023. Those intrusions were reported to include deployment of webshells for persistence, elevated command execution through the compromised application, data exfiltration, and subsequent encryption of victim systems. The group has also been observed exploiting ScreenConnect vulnerabilities and abusing remote management or remote access tooling during intrusions. Reporting on PaperCut exploitation linked the activity to follow-on use of commodity and post-exploitation tooling, indicating a workflow that extends beyond initial compromise into persistence, remote control, and broader post-compromise operations. Bl00dy has maintained public extortion and victim-shaming activity through leak-site and messaging-channel operations, including continued use of Telegram despite briefly announcing a departure from the platform in September 2024. Known aliases include Bl00dy and Bl00dy Ransomware Gang.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a distinct RaaS program advertised on RAMP.
RaaS operation and Conti spin-off linked to laundering activity geolocated to Ghana; targeted healthcare and education organizations primarily in the United States.
Bl00dy is a ransomware group, considered an offshoot of the Conti group, involved in money laundering and ransomware operations, particularly in Africa.
Bl00dy is a ransomware group, considered an offshoot of the Conti group, involved in money laundering and ransomware operations, particularly in Africa.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.