Loading threat actor…
Cicada3301 is a ransomware-as-a-service operation first observed in June 2024. The group runs a double-extortion model that combines file encryption with data theft and operates a leak site to pressure victims. It has been associated with both Windows and Linux/ESXi ransomware variants written in Rust, and technical analysis has identified multiple similarities with ALPHV/BlackCat, including use of ChaCha20 for file encryption, comparable ESXi virtual machine shutdown and snapshot-deletion behavior, and similar ransom-note conventions. Public reporting has assessed that Cicada3301 may be a rebrand, derivative, or code-sharing successor to ALPHV, but a direct relationship remains unverified. Observed tradecraft indicates use of valid accounts for initial access, including access through ScreenConnect, with reporting that the credentials were likely stolen or brute-forced. Activity has also been linked to infrastructure associated with the Brutus botnet, which has been tied to password-guessing attacks against remote access services. The ransomware supports execution controls such as delayed start and user-interface output, validates a supplied key before proceeding with certain operations, embeds an encrypted ransom note within the binary, and uses asymmetric cryptography to protect per-file symmetric encryption material. On ESXi, it has been observed terminating virtual machines and deleting snapshots to maximize impact. Cicada3301 has been reported in victim disclosures and ransomware tracking across multiple sectors and geographies, including incidents affecting healthcare and technology organizations, and it has been counted among active ransomware groups targeting organizations in Japan. Infrastructure overlap has also been reported between Cicada3301 affiliate activity and ShadowSyndicate-linked infrastructure, suggesting ecosystem connections common in the Russian-speaking ransomware landscape, though this does not by itself establish organizational identity. Known aliases include cicada3301, cicada_3301, and cicada3301_ransomware_group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cicada3301 is a ransomware group responsible for two incidents in Japan in the first half of 2025.
A recent RaaS program whose affiliate infrastructure overlaps with ShadowSyndicate, including exfiltration infrastructure and possible ties to ALPHV/BlackCat rebranding theories.
RaaS/extortion group claiming very large data exfiltration against a life sciences testing company.
Ransomware actor listed as active in Q1 2025 targeting industrial sectors.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.