mamba (also tracked as HDDCryptor) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 1 public victims claimed by this operator between May 7, 2020. Mamba is a ransomware group first observed in May 2020, operating with a financially motivated agenda and employing full-disk encryption techniques that distinguish it from many contemporary ransomware families. The group is notable for its use of DiskCryptor, a legitimate open-source disk encryption tool, to encrypt entire volumes rather than individual files, a methodology previously documented by the FBI in a May 2021 Flash Alert warning organizations — particularly in the healthcare and government sectors — about Mamba's destructive potential. Mamba has been linked to activity targeting organizations in the United States, with the healthcare sector identified as a primary focus based on available victimology data, though its overall known victim count remains limited in publicly disclosed reporting. The group's attack chain typically involves gaining initial access through compromised Remote Desktop Protocol (RDP) credentials, followed by deployment of DiskCryptor with attacker-controlled encryption keys, effectively rendering systems inoperable until a ransom is negotiated; notably, Mamba does not appear to consistently employ double extortion through data exfiltration in the manner of more prolific ransomware operations, making recovery dependent on decryption rather than preventing data leakage. No major high-profile campaigns or record ransom demands have been publicly attributed to Mamba by CISA, FBI, or major threat intelligence vendors, reflecting its relatively low operational tempo. Based on available public reporting, Mamba remains a low-to-moderate threat actor with limited documented activity, and no confirmed law enforcement disruption, rebrand, or dissolution has been publicly reported as of available intelligence.

Recent disclosures by mamba

All 1 indexed disclosures. Click any row for the full per-victim dossier.

• Unnamed health care companyHealthcare · US · May 7, 2020

See every disclosure indexed for mamba →