Inactive ransomware operator
← All groupsRook
9 victims indexed · first seen 4 years ago · last activity 4 years ago
At a glance
- Status
- inactive
- First seen
- 4 years ago
- Last activity
- 4 years ago
- Onion sites
- 1 known endpoint
About
References
11 linksExternal sources curated by the MISP threat-intel community.
- sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk
- twitter.com/techyteachme/status/1464317136944435209
- blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/
- chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/
- github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit.md
- seguranca-informatica.pt/rook-ransomware-analysis/
- microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself
- microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
- secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader
- sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/
- ransomlook.io/group/rook
Timeline
2 monthsTop countries
MITRE ATT&CK
4 techniques · 4 tacticsTactics
Recent victims
Loading…
Onion infrastructure
1 known- http://gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion
Source
Updated 4 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
