Loading story…
The Yanluowang ransomware operation targeted U.S. organizations, with a particular focus on the financial sector, using BazarLoader during reconnaissance and initial compromise before expanding access through enabled RDP and remote-management tools such as ConnectWise. Intrusions documented by Symantec and linked reporting showed the actors conducting network discovery with tools including AdFind and SoftPerfect Network Scanner, while also deploying credential-theft and data-exfiltration utilities ahead of ransomware deployment. U.S. government reporting on FiveHands provides additional context for tradecraft overlaps that researchers said may indicate ties to earlier ransomware-as-a-service activity, though direct shared authorship was not confirmed.
A later leak of Yanluowang internal chats, infrastructure details, and source code exposed a more structured criminal enterprise, with separate roles for development, negotiations, social engineering, pentesting, and DDoS operations. The leaked material suggested links to Thieflock, PayloadBIN, Conti, and references to REvil, while indicating the group avoided targets in former Soviet states and took steps to discuss operational security and money laundering. Researchers said the leak appears to have disrupted the gang’s operations, with onion sites reportedly going offline, but warned that publication of the ransomware source code and builder could aid both defenders and future threat actors seeking to reuse the tooling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Darktrace published an analysis of leaked internal chats, infrastructure details, and source code, identifying at least eighteen people involved and describing a structured division of labor across development, negotiations, social engineering, pentesting, and DDoS roles. The analysis also highlighted possible links to PayloadBIN, Conti, and Thieflock-related ecosystems.
Kaspersky reported a cryptographic weakness in Yanluowang's encryption scheme that allows file recovery via a known-plaintext attack. The company added free Yanluowang decryption support to its Rannoh tool to help victims recover encrypted files.
Trend Micro analyzed newly observed Yanluowang ransomware samples and reported that the binaries were code-signed with a valid digital signature at the time of analysis. The report also documented the malware's use of command-line execution, termination of database, backup, email, and administrative processes and services, and attempts to stop virtual machines to increase operational impact on victims.
Symantec reported that Yanluowang attacks were continuing against higher-profile U.S. targets and assessed that the actor appeared to be an experienced ransomware affiliate. The company said the activity may be tied to a former Thieflock/FiveHands affiliate, though the connection remained tentative and without proof of shared authorship.
On 31 October, the @yanluowangleaks account shared Yanluowang Matrix chat leaks, server leaks, the builder, and decryption source. The leak included six files containing internal conversations between group members.
Symantec's Threat Hunter Team first identified Yanluowang in October 2021, marking the firm's initial observation of the ransomware operation.
The group was described as operational since August 2021, and a threat actor used Yanluowang to attack U.S. corporations that month. Those attacks reportedly shared similar tactics, techniques, and procedures with Thieflock/FiveHands activity.
CISA published analysis report AR21-126A on FiveHands ransomware, documenting the malware family later referenced in assessments of possible links to Yanluowang activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
de.darktrace.com
Open sourcesecurelist.com
Open sourcetrendmicro.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourcebleepingcomputer.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceus-cert.cisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple **BazaLoader** campaigns that used high-interaction phishing lures, including Valentine’s Day retail themes and DocuSign-themed spreadsheets, to trick users into visiting spoofed sites, downloading malicious Excel files, and enabling macros. Once executed, the malware established persistence, injected into legitimate processes, contacted command-and-control infrastructure, and used evolving techniques such as updated `.bazar` domain-generation logic and heavily obfuscated strings to hinder detection and analysis. Incident reports showed BazaLoader frequently serving as an initial access loader for broader intrusions that quickly escalated to **Cobalt Strike**, **AdFind** reconnaissance, credential theft, lateral movement, and in some cases **Anchor DNS** deployment, behavior widely associated with **Ryuk** and later **Conti** ransomware operations. In one case, reconnaissance began within 41 minutes of infection; in another, attackers progressed from a single endpoint to domain controller access over five days, reinforcing assessments that BazaLoader was a key entry point in enterprise ransomware playbooks tied to TrickBot-aligned affiliates.
Aug 15, 2026
SentinelLabs profiled a Maze ransomware affiliate tracked as **SNOW**, detailing how the actor gained access mainly through exposed RDP services and SMB exploitation before deploying a custom Maze loader commonly called **DllCrypt** alongside tools including **Cobalt Strike**, **Metasploit**, and **Mimikatz**. Reverse engineering showed the loader used **Sosemanuk** encryption with hardcoded keying material to decrypt an in-memory loader and the final Maze payload, and included an AhnLab-themed killswitch file check. The investigation also linked the affiliate to wider eCrime activity through overlaps with **Zloader**, **Gozi**, and **TrickBot**, including shared certificates, crypter traits, and infrastructure patterns. Mandiant’s reporting shows those findings fit Maze’s broader operating model as an affiliate-driven ransomware enterprise that shifted from early spam and exploit-kit delivery to post-compromise deployment, enabling network-wide encryption and **double extortion** through stolen-data leaks. Across incidents, Maze operators used credential theft, Active Directory reconnaissance, lateral movement over **Cobalt Strike BEACON** and RDP, and exfiltration through FTP, **WinSCP**, and cloud storage, while often dwelling in victim environments for weeks or months before encrypting high-value systems. The combined reporting depicts a patient, multi-stage intrusion model in which specialized actors obtained access, escalated privileges, mapped enterprise networks, stole data, and then launched Maze ransomware at scale.
Aug 15, 2026
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026