payload · Ransomware · RaqibCTI

Knowledge/Actors/payloadCorpus

+ Request intel workspace

ransomware

payload

Provisional

Ransomware

Motivation

—

Attribution confidence

Provisional — not yet assessed

Corpus activity · 6mo7 mentions

AMJJAS

Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, unrated confidence.

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

1 relevant alert →

Associated with

Related to

payload · AmateracampaignCorrelated cluster2026-09-21
payload · XMRigcampaignCorrelated cluster2026-09-03
payload · XMRigcampaignCorrelated cluster2026-08-26

Targets

Zara Investment HoldingtargetLeak-site claim · ransomware.live2026-08-13
Software ArgetargetLeak-site claim · ransomware.live2026-06-26
Al Sulaiti Law FirmtargetLeak-site claim · ransomware.live2026-04-20
orientalweavers.comtargetLeak-site claim · ransomware.live2026-04-16

Overview Attribution¹ TTPs Indicators Reporting Coverage

Recent mentions

Latest Intel →

2026-09-23Help AG (e& enterprise) — Top Middle East Cyber Threats – 23 September 2026 ↗2026-09-21Kaspersky Securelist — Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO ↗2026-09-10Check Point Research — PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector ↗2026-09-09Unit 42 (Palo Alto Networks) — Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure ↗2026-09-08Cisco Talos — ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager ↗2026-08-31Kaspersky Securelist — ValleyRAT masquerading as adware ↗

Useful?

El Wastani Petroleum Company (WASCO)target

Leak-site claim · ransomware.live2026-04-08

→United Finance EgypttargetLeak-site claim · ransomware.live2026-04-03

→SAYEGHtargetLeak-site claim · ransomware.live2026-04-01

→A A Al Moosa Enterprises (ARENCO Group)targetLeak-site claim · ransomware.live2026-03-28

→Royal Bahrain HospitaltargetLeak-site claim · ransomware.live2026-03-15

→sodic.comtargetLeak-site claim · ransomware.live2026-02-17

Related

Semantically related in the corpus — a discovery aid, not asserted attribution.

Actorapt73
Actornightspire
Actorkrybit
ActorGunra
ActorDoommageddon
Actorlockbit5

Suggested · co-occurring (unverified)

These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.

TechniqueT1105co-mentioned in 3 items
SectorGovernmentco-mentioned in 2 items
TechniqueT1574.002co-mentioned in 2 items
TechniqueT1027co-mentioned in 2 items
MalwarePAYLOADco-mentioned in 1 item
TechniqueT1078co-mentioned in 1 item
TechniqueT1133co-mentioned in 1 item
TechniqueT1562.004co-mentioned in 1 item
SectorManufacturingco-mentioned in 1 item
Sectorgamingco-mentioned in 1 item
MalwareInsomnia RATco-mentioned in 1 item
SectorCritical Infrastructureco-mentioned in 1 item
MalwareSocks5Systemzco-mentioned in 1 item
TechniqueT1566co-mentioned in 1 item
MalwareARKTunnelco-mentioned in 1 item
MalwareGCleanerco-mentioned in 1 item
MalwareDocro Hijackerco-mentioned in 1 item
SectorCorporateco-mentioned in 1 item
MalwareZigCryptoStealerco-mentioned in 1 item
TechniqueT1089.005co-mentioned in 1 item
MalwareAmateraco-mentioned in 1 item
MalwareNetSupport Managerco-mentioned in 1 item
CountryUkraineco-mentioned in 1 item
TechniqueT1218.011co-mentioned in 1 item
TechniqueT1059.001co-mentioned in 1 item
TechniqueT1059.007co-mentioned in 1 item
CountryIndiaco-mentioned in 1 item
TechniqueT1548.002co-mentioned in 1 item
CountryChinaco-mentioned in 1 item
TechniqueT1082co-mentioned in 1 item