Pr0meth3us🔥

Security Researcher @Morphisec 🕵👨‍💻 Reporting intelligence assessments and breaking malware 👾📄
Make the world safe 🛡🌐

[Pr0meth3us🔥 @MrRightQuestion]

My latest research of #Pay2Key #Linux #Ransomware is out.
I first covered that variant generation ability back in July 2025 through the Pay2Key[.]I2P platform.
After completing the reversing process it hit me. That there is more to it.

[Morphisec @morphisec]

Linux ransomware doesn’t get nearly as much attention as Windows threats. 🐧

But that’s changing.

Many ransomware groups are quietly adding Linux variants to target the infrastructure organizations depend on most: servers, virtualization hosts, and cloud workloads.

Morphisec Threat Labs recently analyzed the Pay2Key Linux ransomware variant - a configuration-driven encryptor designed to:

🔹Traverse large filesystem environments
🔹Disable Linux defenses like SELinux and AppArmor
🔹Encrypt data using configurable ChaCha20 modes
🔹Maintain stability to avoid crashing hosts mid-attack

Even more interesting? Many of the techniques used here are showing up across multiple ransomware families targeting Linux environments today.

In this research, we break down how the malware operates and what security teams need to understand about the growing Linux ransomware threat landscape. Read the blog and the full threat analysis - Links in the comments.

[Pr0meth3us🔥 @MrRightQuestion]

Avoid overclaim and subjective terms when reporting the findings, jumping to conclusion will only hurt your knees and leave a bad mark on future findings.

[Pr0meth3us🔥 @MrRightQuestion]

Okay, I'll say it.
#Intelligence does not need more numbers and statistics most of the people present in the room where this should matter can't read anyway.

[Pr0meth3us🔥 @MrRightQuestion]

Instead, do the effort and explain (in simple terms 👀) the context of the intelligence research and provide evidence based unfolding of events.

[Pr0meth3us🔥 @MrRightQuestion]

@ZackKorman Looks like the natural fallout of the same problem you mentioned in your other post, sales becoming really good with pitches it is now turning to "Our security against X is Y's product".
Honestly? If you can't properly understand the threat any product becomes a fitting solution.

[Pr0meth3us🔥 @MrRightQuestion]

@MosheTov Cursor file size only competing with CoD:MW install file ~300GB

[Pr0meth3us🔥 @MrRightQuestion]

Ayo! Remember how #VECT 2.0 was soooo poorly written it actually turned it into a wiper because Vect let the nonce go out the window?
Well y'all gonna want to read my buddy's report.
Uh and another small thing... @morphisec's product can ACTUALLY decrypt large files back

[Morphisec @morphisec]

What happens when ransomware can't even decrypt the files it encrypted?

This latest blog from Morphisec threat researcher Yonatan Edri takes a closer look at VECT ransomware and uncovers a troubling reality: some victims may be left with files that are renamed, partially encrypted, corrupted, or otherwise unrecoverable - even when a decryptor is available.

While researchers have already documented VECT's nonce management flaw, our analysis found additional Windows-specific implementation issues that can create inconsistent file states and complicate recovery efforts.

Key findings:
✅Files are renamed before encryption begins, meaning a .vect extension doesn't necessarily indicate successful encryption.
✅Medium-sized files may be processed through a flawed buffer handling routine, potentially resulting in failed or incomplete encryption.
✅Shared global buffers introduce the possibility of file corruption under concurrent execution.
✅Large files can be modified using multiple encryption operations while retaining insufficient metadata for reliable restoration.

The result? Not all ransomware incidents produce cleanly encrypted files—and not all decryptors can put them back together.

The research reinforces an important lesson for defenders: recovery is not always guaranteed. Organizations need security strategies focused on preventing ransomware execution before encryption occurs, while maintaining the ability to recover affected files when attacks succeed.

Read the full analysis - link in the comments.

[Pr0meth3us🔥 @MrRightQuestion]

Show me AI being prosecuted for malpractice in hospitals or white collar crimes because it failed to comply with tax regulations and we can talk.

[Pr0meth3us🔥 @MrRightQuestion]

@angelshalagina In civilized sociaties it is easier to convice the reasonable to compromise instead of battling the unreasonable, because tactically it achieves a faster resolution while
strategically it fails to resolve the issue. On a personal note, this is sad.

[Pr0meth3us🔥 @MrRightQuestion]

@vxunderground Imagine phishing emails being as polite as smelly when comes to downloading malware, a utopian world.

[Pr0meth3us🔥 @MrRightQuestion]

@ZackKorman Can we do the CTI community copy-pasting posts from forums calling this "intel" next? 😉

[Pr0meth3us🔥 @MrRightQuestion]

@MosheTov Their loss man, you got some good pieces to talk about

[Pr0meth3us🔥 @MrRightQuestion]

Chat, is this a "help us find our Mini Shai Hulud" recruiting wave?
@MosheTov 👀

[Thomas Roccia 🤘 @fr0gger_]

People working in Threat Intel & AI, this is your time 😉

[Pr0meth3us🔥 @MrRightQuestion]

@_turcid NOW I CAN SEE THE WHALESSSSSSS

[Pr0meth3us🔥 @MrRightQuestion]

@_winter_wonders

[Pr0meth3us🔥 @MrRightQuestion]

@MosheTov 20k signing bonus

[Pr0meth3us🔥 @MrRightQuestion]

I swear everytime I hear about #Nova #RaaS they come up with a new department.
I'm convinced Nova's org chart is a circled linked list

[Dark Web Intelligence @DailyDarkWeb]

🌏 Nova Ransomware Expands Public Leak Operations

The group known as “Nova Ransomware” has published multiple new alleged victims on its leak platform, including organizations from Brazil’s technology and e-commerce sectors.

The post references several companies and claims large volumes of internal corporate data were exfiltrated and published after failed negotiations.

This type of “leak spread” activity continues to highlight how modern ransomware groups increasingly rely on:

public exposure
reputational pressure
staged leak releases
psychological operations against victims

At this stage, the authenticity and scope of the exposed data remain unverified.

DDW is monitoring the activity for additional validation, victim confirmation, and technical indicators.

#Ransomware #CyberSecurity #DataLeak #ThreatIntel #DarkWeb #Infosec #DDW

[Dark Web Intelligence @DailyDarkWeb]

🌏 Nova Ransomware Expands Public Leak Operations

The group known as “Nova Ransomware” has published multiple new alleged victims on its leak platform, including organizations from Brazil’s technology and e-commerce sectors.

The post references several companies and claims large volumes of internal corporate data were exfiltrated and published after failed negotiations.

This type of “leak spread” activity continues to highlight how modern ransomware groups increasingly rely on:

public exposure
reputational pressure
staged leak releases
psychological operations against victims

At this stage, the authenticity and scope of the exposed data remain unverified.

DDW is monitoring the activity for additional validation, victim confirmation, and technical indicators.

#Ransomware #CyberSecurity #DataLeak #ThreatIntel #DarkWeb #Infosec #DDW

[Pr0meth3us🔥 @MrRightQuestion]

@RussianPanda9xx Sounds about right 😂😂😂