samas (also tracked as Samas-Samsam, samsam.exe, MIKOPONI.exe, RikiRafael.exe) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 1 public victims claimed by this operator between February 16, 2018. Samas is a ransomware group first observed in February 2018, operating with primary financial motivation and demonstrating a focused targeting pattern against public sector organizations in the United States. Based on available data, the group has a limited documented victim count of one known target, suggesting either a highly selective operational tempo or limited public attribution of their activities; no definitive country of origin or confirmed affiliation with broader ransomware ecosystems has been publicly established by CISA, FBI, Mandiant, or other reputable threat intelligence sources under this specific group designation. It is worth noting that "SamSam" ransomware, a similarly named and well-documented threat, was extensively profiled by the FBI and CISA as a financially motivated actor employing manual deployment techniques, exploiting vulnerabilities in public-facing applications such as JBoss, and conducting targeted intrusions rather than mass-distribution campaigns, and it is possible this entry represents a variant spelling or related attribution cluster. Given the limited public intelligence available specifically under the "Samas" designation with the parameters provided, analytical confidence in detailed attribution, tooling, or campaign specifics remains low, and analysts should cross-reference with SamSam documentation and broader public sector ransomware reporting for contextual enrichment. The current operational status of this group cannot be definitively confirmed based on publicly available documented sources.

Recent disclosures by samas

All 1 indexed disclosures. Click any row for the full per-victim dossier.

• Davidson CountyPublic Sector · US · February 16, 2018

See every disclosure indexed for samas →