Overview
RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.
- First tracked: 2020-05-14
- Discussed in our reports: Qatar
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America11
Japan3
Italy3
India2
Trinidad and Tobago2
Indonesia2
Spain2
Brazil2
Canada2
France2
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| Jenkins | Jenkins | CVE-2024-23897 | Applications | blogs.juniper.net, www.cloudsek.com |
| SAP | NetWeaver | CVE-2025-31324 | Applications | reliaquest.com |
| Windows | CLFS | CVE-2025-29824 | Microsoft | microsoft.com |
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
- LaZagne
- Mimikatz
- ProcDump
- BCDEdit
- Windows Event Utility (wevtutil)
- Cobalt Strike
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| RansomEXX v2 | DLS | rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11