Loading threat actor…
Prometheus is a ransomware operation first observed in early 2021 and widely assessed as a Thanos-derived threat actor rather than a genuine affiliate or sub-group of REvil, despite its public claims of association with REvil. The group used ransomware built from leaked Thanos code in C#/.NET and operated a leak site and negotiation infrastructure consistent with double-extortion operations. Prometheus encrypted victim files, threatened to publish or sell stolen data, used countdown-based pressure during negotiations, and appears to have listed dozens of victims before going inactive in mid-2021. Some reporting later suggested a possible operational link or rebrand into Haron, another Thanos-based ransomware group, but that linkage is not firmly established. Prometheus targeted organizations across multiple sectors, with manufacturing and transportation/logistics notably represented, alongside government, financial services, consulting, agriculture, healthcare, insurance, energy, and legal organizations. Victims were reported in the United States, the United Kingdom, Brazil, Peru, Austria, Singapore, France, Norway, Switzerland, the Netherlands, Malaysia, the United Arab Emirates, and other regions across Europe, Asia, the Middle East, and South America. Operationally, Prometheus used double extortion with dedicated leak-site publication and ticket-based ransom negotiation. Observed ransom demands varied by victim and were increased when victims delayed contact. The malware family was characterized by victim-specific file extensions, standard ransom notes in text and HTA formats, and technical markers associated with the Thanos builder. Multiple analyses describe Prometheus samples encrypting data with Salsa20, while at least one later report on a Prometheus-linked modified Thanos sample described AES-based encryption; the common high-confidence conclusion is that the actor used customized Thanos-derived ransomware variants. Prometheus ransomware behavior included terminating backup, database, office, and security-related processes and services to facilitate encryption and inhibit recovery; disabling or interfering with anti-ransomware protections such as Raccine; modifying service configurations; and, in some reporting, altering firewall settings and registry data as part of pre-encryption preparation. Older Prometheus variants relied on email and third-party messaging services for victim contact before the group matured into a dedicated leak-site and negotiation model. Prometheus is best understood as a financially motivated ransomware actor in the 2021 wave of Thanos-derived extortion groups, alongside related variants such as Haron, Spook, and Midas. Its activity illustrates how leaked ransomware builders enabled rapid rebranding, customization, and scaling of extortion operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
92 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Thanos-derived ransomware variant that used double extortion and operated a leak site to pressure victims into paying.
A ransomware group whose operations appear to have declined or ceased after release of a free decryptor. The group had listed more than 40 victims on its leak site and used a Thanos-based ransomware strain.
Emerging ransomware gang conducting double-extortion attacks, operating a leak site and victim ticketing system, and targeting multiple industries globally using a personalized variant of Thanos ransomware.
Ransomware group resurfacing via a dark web blog and using a modified Thanos ransomware sample in recent attacks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.