Loading malware…
Rorschach, also known as BabLock, is a ransomware family first publicly identified in 2023 and assessed to have been active since at least 2022. It is notable for unusually fast encryption and for combining design elements associated with multiple ransomware lineages, including leaked Babuk code and traits resembling LockBit and DarkSide. The Windows variant is more customized and technically sophisticated than the Linux and ESXi variants, which have been linked to Babuk-derived code bases.
Rorschach has been observed in targeted intrusions against enterprise environments, including industrial organizations, and has also been linked in public reporting to attacks affecting academic institutions. It has been used against Windows systems, Linux hosts, VMware ESXi environments, and network shares. Reported operations have included exploitation of internet-facing software vulnerabilities for initial access, followed by lateral movement with administrative remote access and post-compromise tooling. Associated intrusion activity has included use of credential theft utilities, tunneling tools, reconnaissance scanners, and Kerberos-focused tooling.
On Windows, Rorschach has been deployed as a multi-component package that uses DLL sideloading with a legitimate executable, an encrypted payload component, and a loader commonly referred to as DarkLoader. The loader decrypts the ransomware payload and injects it into memory, including into a suspended benign process, after validating required execution parameters. Reported anti-analysis and evasion features include direct syscalls, string obfuscation, packing, process argument spoofing, and in-memory execution. The malware has also been observed clearing event logs, deleting shadow copies and backups, disabling recovery options, attempting to weaken host defenses, and abusing a legitimate security-product uninstaller to terminate antivirus, EDR, backup, and database processes.
Rorschach supports propagation and enterprise-scale impact through Active Directory abuse. When executed with sufficient privileges on a domain controller, it can enumerate domain systems and deploy malicious Group Policy objects and scheduled tasks to spread across hosts. Public reporting also describes encryption of local disks, shared storage, and virtualized infrastructure. The family has been characterized as primarily single-extortion oriented, with victim communication conducted directly rather than through a conventional leak site, although public reporting has not consistently established data theft in all observed incidents.
The malware family includes platform-specific cryptographic implementations across Windows, Linux, and ESXi variants, and its ransom-note content and operational tradecraft indicate a hybrid construction rather than a straightforward reuse of a single predecessor family. Security vendors and incident responders commonly refer to this ransomware as Rorschach, while BabLock remains a widely used alternate name.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
To gain initial access to the victim’s infrastructure, the attackers used a remote code execution (RCE) vulnerability in the email software Zimbra Collaboration (ZCS) 8.8.15 and 9.0, namely CVE-2022-41352 that enables a threat actor to remotely execute arbitrary code. | The strain, first uncovered by Group-IB researchers in January 2023, was codenamed BabLock, because its versions for Linux and ESXi share similarities with the leaked Babuk ransomware. Additionally, BabLock gang (also tracked under the name “Rorschach” by CheckPoint)...
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Public reports confirm that the University suffered a ransomware attack that disrupted its operations... “What appears certain is the use of a next-generation ransomware strain known as ‘Bablock,’ ... The media report links the security breach to Bablock/Rorschach ransomware based on malware traits and tactics. First seen in 2023, this malware family borrows code from leaked Babuk, LockBit v2.0, and DarkSide code.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
For the ransomware to spread in the victim’s infrastructure, a group policy (GPO) is used, which creates scheduled tasks on domain hosts to launch the ransomware and stop SQL system services.
Group policies on domain computers are updated using the following PowerShell command: powershell.exe -Command "Get-ADComputer -filter * ... Invoke-GPUpdate ..."
A CMD file to execute the non-malicious binary using the correct password
BabLock Ransomware MITRE ATT&CK ... T1059.004 Command and Scripting Interpreter: Unix Shell The attackers used Unix Shell to perform various actions on hosts running Linux.
The DarkLoader DLL uses Direct SysCall APIs to a select few, but important, calls to avoid API reading analysis.
For the ransomware to spread in the victim’s infrastructure, a group policy (GPO) is used, which creates scheduled tasks on domain hosts to launch the ransomware and stop SQL system services.
For the ransomware to spread in the victim’s infrastructure, a group policy (GPO) is used, which creates scheduled tasks on domain hosts to launch the ransomware and stop SQL system services.
BabLock is loaded via the threat injection of a hooked API Ntdll.RtlTestBit to jump to memory containing the ransomware code.
When winutils.dll is loaded, its code decrypts ... a shellcode from the file config.ini, launches the process %SystemRoot%\system32\notepad.exe in a suspended state, and injects the shellcode in it.
After successfully exploiting this vulnerability, the attackers connected to the domain controller from a compromised Zimbra server via a Remote Desktop Protocol (RDP). To do so, they used a domain administrator account.
The winutils.dll module is compressed using a modified UPX 3.96 packer ... Unpacking revealed other protective techniques in the DLL, such as string obfuscation, junk code...
It separates and hides the actual payload into an encrypted file. It uses normal applications as loaders
BabLock is loaded via the threat injection of a hooked API Ntdll.RtlTestBit to jump to memory containing the ransomware code.
When winutils.dll is loaded, its code decrypts ... a shellcode from the file config.ini, launches the process %SystemRoot%\system32\notepad.exe in a suspended state, and injects the shellcode in it.
wevtutil.exe clear-log Application wevtutil.exe clear-log Security wevtutil.exe clear-log System wevtutil.exe clear-log "windows powershell"
After successfully exploiting this vulnerability, the attackers connected to the domain controller from a compromised Zimbra server via a Remote Desktop Protocol (RDP). To do so, they used a domain administrator account.
When winutils.dll is loaded, its code decrypts (using RC4 encryption algorithm) a shellcode from the file config.ini.
BabLock illustrates the danger of that sequence. The ransomware was observed abusing a legitimate vendor uninstaller, terminating a set of antivirus, EDR, backup, and database processes, then clearing Security and System event logs.
The decrypted BabLock ransomware is always packed with VMProtect for anti-virtualization.
When these commands are executed, the ransomware uses an artifact hiding technique called process argument spoofing: it creates a system program process in a suspended state, writes command-line arguments directly into the PEB, and then resumes the process.
The files Registry.pol and comment.cmtx ... are intended for disabling Windows Defender on hosts by modifying relevant parameters in the system registry.
The ransomware stops the following security, backup, database management and other system services: vss ccSetMgr veeam sql ...
To search for network resources, the ransomware also enumerates Active Directory computers using LDAP queries.
The ransomware also terminates the following processes of database management systems, email clients, office applications, etc.
The ransomware encrypts files on disks and available network resources. Before encryption, the ransomware mounts hidden volumes.
The ransomware encrypts files on disks and available network resources.
70 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family observed abusing a legitimate uninstaller to remove protections, terminate security and backup processes, and clear Windows event logs before encryption.
Next-generation ransomware used for extortion; reported to disrupt operations and encrypt data. The reporting notes it typically avoids encrypting systems configured for Russian or other post-Soviet languages and is assessed to borrow code from Babuk, LockBit v2.0, and DarkSide.
Ransomware strain (appeared in 2023) noted for rapid file encryption.
Ransomware family reportedly used in the La Sapienza University incident; associated with ransom demands and service disruption consistent with file-encrypting/extortion activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.