Loading malware…
Bl00dy is a ransomware operation active since at least 2022 and commonly referenced as a ransomware-as-a-service program or ransomware gang. Reporting links it to the Russian-speaking cybercrime ecosystem and describes it as an offshoot of Conti. The group has been associated with use of leaked or reused ransomware builders rather than wholly original tooling, including builders tied to LockBit, Babuk, and Conti, with LockBit-derived tooling reportedly used from September 2022 onward.
Bl00dy has been observed exploiting vulnerable internet-exposed PaperCut MF and NG servers, particularly through CVE-2023-27350. In early May 2023, intrusions attributed to the group targeted organizations in the U.S. Education Facilities Subsector. These compromises led in some cases to data exfiltration followed by encryption of victim systems and ransom demands for decryption, indicating a double-extortion model. Broader reporting also places Bl00dy among ransomware groups exploiting PaperCut vulnerabilities alongside other major ransomware actors.
The operation has appeared in cybercriminal marketplace and affiliate ecosystems, including listings among ransomware programs advertised on Russian-language forums. Its activity illustrates the lowered barrier to entry in the ransomware landscape, where actors can combine public or leaked builders, acquired access, and commodity post-exploitation tooling to conduct extortion operations. Bl00dy is primarily associated with financially motivated attacks against organizational networks, with confirmed impact on Windows and Linux environments through exploitation of PaperCut servers that can execute with elevated privileges.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cicada3301 operators in February 2024 sought to exploit ScreenConnect vulnerabilities, (CVE-2024-1708 and CVE-2024-1709). The same vulnerabilities were also extensively exploited according to Trendmicro by other top tier ransomware such as BlackBasta ... and Bl00dy ransomware.
Cicada3301 operators in February 2024 sought to exploit ScreenConnect vulnerabilities, (CVE-2024-1708 and CVE-2024-1709). The same vulnerabilities were also extensively exploited according to Trendmicro by other top tier ransomware such as BlackBasta ... and Bl00dy ransomware.
In early May 2023, according to FBI information, the Bl00dy Ransomware Gang gained access to victim networks across the Education Facilities Subsector where PaperCut servers vulnerable to CVE-2023-27350 were exposed to the internet. Ultimately, some of these operations led to data exfiltration and encryption of victim systems.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In early May 2023, according to FBI information, the Bl00dy Ransomware Gang gained access to victim networks across the Education Facilities Subsector where PaperCut servers vulnerable to CVE-2023-27350 were exposed to the internet. Ultimately, some of these operations led to data exfiltration and encryption of victim systems.
...attacks targeting PaperCut printing servers with Clop, Bl00dy, and LockBit ransomware.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
RAMP hosted 60 threads in its dedicated RaaS section, where ransomware operators recruit affiliates... We identified 14 distinct RaaS programs: AvosLocker, Conti, Luna, BEAST, Nevada, CryptNet, Knight 3.0, NoEscape, Bl00dy, KUIPER, UBUD, PHOBOS, Zeppelin2, Wing 1.0.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware-as-a-service program advertised on RAMP.
Bl00dy is a ransomware group, considered an offshoot of the Conti ransomware group, involved in money laundering and ransomware operations.
Bl00dy is a ransomware group, considered an offshoot of the Conti ransomware group, involved in money laundering and ransomware operations.
Ransomware family said to use leaked builders from Conti and LockBit Black and to exploit various vulnerabilities including a PaperCut flaw.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.