Ransomexx

Inactive

RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.

86 Victims

May 13, 2020 First Discovered

Jun 19, 2026 Last Discovered

135 Days Inactive

0% Infostealer

0/1 Sites Online

Known Locations (1)

RansomEXX v2

rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion

Tools Used

CredentialTheft

LaZagne, Mimikatz, ProcDump

LOLBAS

BCDEdit, Windows Event Utility (wevtutil)

Offsec

Cobalt Strike

Intelligence

📄 5 Ransom Notes
View the actual ransom notes used by this group →

Victims (86)

Detailed victim list temporarily unavailable

This group has 86 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.