{
  "name": "Key Group uses leaked builders of ransomware and wipers",
  "slug": "key-group-uses-leaked-builders-of-ransomware-and-wipers",
  "description": "Key Group, also known as keygroup777, is a financially motivated ransomware group primarily targeting Russian users. The group has been active since 2022, using various leaked ransomware builders and wipers, including Xorist, Chaos, Annabelle, Slam, RuRansom, UX-Cryptor, Hakuna Matata, and Judge/NoCry. They distribute their malware through phishing emails and GitHub repositories, often using multi-stage loaders. Key Group employs various persistence methods and primarily communicates with victims via Telegram. The group is suspected to be a subsidiary project of the Russian-speaking 'huis' group, known for conducting spam raids on Telegram channels. Key Group's use of publicly available ransomware builders highlights a growing trend among cybercriminal groups.",
  "published": "2024-10-02T06:51:20+00:00",
  "created_at": "2024-10-02T06:51:20+00:00",
  "modified_at": "2024-10-02T08:52:31+00:00",
  "created_at_opencti": "2024-10-02T06:51:20+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-10-02",
    "annabelle",
    "chaos",
    "hakuna matata",
    "judge/nocry",
    "leaked builders",
    "multi-stage loaders",
    "njrat",
    "persistence",
    "phishing",
    "ransomware",
    "ruransom",
    "russian-speaking",
    "slam",
    "telegram",
    "ux-cryptor",
    "wiper",
    "xorist"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "make-catherine.at.ply.gg"
      },
      {
        "id": "",
        "name": "f981e6f147e30b54a386239409d381801ecf082f64bffb91f8f8b05b89236fa3"
      },
      {
        "id": "",
        "name": "f43a122bd4356516d170e63185e0a523d17b9a2022e58d3b16e72e42bcf5e914"
      },
      {
        "id": "",
        "name": "dc8abf94a1c51cb7bfe4172fca1b5e3fe8b42eefc9e17b45ce5263e5d5cabb16"
      },
      {
        "id": "",
        "name": "f37452ab619dac62881a4de8dc2d716c7a0cb023ca8f20abf40bc7d3f198172f"
      },
      {
        "id": "",
        "name": "da5e78ad0e38c951bb4b53adcc5afe693c2e33533a45a9c666a8dc9852766ffd"
      },
      {
        "id": "",
        "name": "cf9be6bf5426c5138d3e6102ff1524480e1154aa29cb67d81a1a2d9087ebf471"
      },
      {
        "id": "",
        "name": "ca073b77bb9d36ab8aeec19b780f59024b5bb5d985312fb9ad0aa52adeb28775"
      },
      {
        "id": "",
        "name": "c4bfc91bdf1a923a602819485e98f26406b0293c83e0552635bef374420430c4"
      },
      {
        "id": "",
        "name": "b83cdc460fda3201dda1f3127e51041bd929101de1033d420a1c450890411564"
      },
      {
        "id": "",
        "name": "bf17f462722749cdbad455170d45b0b314311178207921a3ea9144b03eb31eb2"
      },
      {
        "id": "",
        "name": "b26784415a946873e073c3838499fb1bea96f1b6a637e15f1ae85662f8598979"
      },
      {
        "id": "",
        "name": "91b620e308d2b19a3ddbad0b8ecb49de9afa28d13f6aaac201c5fd2c03f4dd45"
      },
      {
        "id": "",
        "name": "8da2c94ce8fdf080155fbf1a373751eaeecd19d7acb2c67d9fe3591ca59a570f"
      },
      {
        "id": "",
        "name": "7eb42bb9392020befa617a3bc5f98e11eb1e4cfae22e1dde1b3b7cabc225a325"
      },
      {
        "id": "",
        "name": "6b96ca1829e4c8612b90865bd69b11ca98508acad7338e89a28e676576feceea"
      },
      {
        "id": "",
        "name": "4ed9ef7eef055ac73033b823d7d89a84acf80669ffbc88eac7b6c5093722dc82"
      },
      {
        "id": "",
        "name": "40040e55f9d9d3485ef73b98b994ef895ae0dd2fd3e187d027e3a1106a1e2650"
      },
      {
        "id": "",
        "name": "3067211fbac8c7dab30074dc15c280b91589e14680d89e2927ccf2e470d2dbd3"
      },
      {
        "id": "",
        "name": "24533220477a29dd5f2179f66295d75e9e4401a0c413fddd8b3bce9de7fd65f8"
      },
      {
        "id": "",
        "name": "1dc05f28533a88807c1dca013c1bffa9a7afd78da1426c1fc329861dab11e5f5"
      },
      {
        "id": "",
        "name": "0353e25eb6b5a7151861a6f69c3c4505a3021d1831376c3374a091f8e4cd1112"
      },
      {
        "id": "",
        "name": "0cbca1a748510ca17fa6af478c90e8c2faccd885ed36ad54fb211b427c94161c"
      },
      {
        "id": "",
        "name": "1319bcc0aa02b8aa4aff182005ce9cd2a6b43b295844ba98221da623397a4cb6"
      }
    ],
    "malware": [
      {
        "id": "e926c9d9-c29d-47c9-abc2-086b2df236e2",
        "name": "Hakuna Matata",
        "slug": "hakuna-matata"
      },
      {
        "id": "427b6841-ffbc-4326-82d8-619668f95bcc",
        "name": "Judge/NoCry",
        "slug": "judgenocry"
      },
      {
        "id": "c3ea47da-689f-4628-a350-ab0e70217a37",
        "name": "UX-Cryptor",
        "slug": "ux-cryptor"
      },
      {
        "id": "86ba452a-ab6d-4741-9f6a-710669710c3a",
        "name": "RuRansom",
        "slug": "ruransom"
      },
      {
        "id": "7c68068c-f51e-43a2-98df-2cf946e6c074",
        "name": "Slam",
        "slug": "slam"
      },
      {
        "id": "63af4d1c-b1c5-436b-bbd5-84161ee37317",
        "name": "Annabelle",
        "slug": "annabelle"
      },
      {
        "id": "c95210fe-62a8-47e6-af77-5409c8649aef",
        "name": "Xorist",
        "slug": "xorist"
      },
      {
        "id": "8d81304d-cd1d-41ae-9c7e-16fbc59dd11e",
        "name": "Chaos - S0220",
        "slug": "chaos-s0220"
      },
      {
        "id": "50b0256e-3b81-4f32-b915-979cc893dc27",
        "name": "LV",
        "slug": "lv"
      },
      {
        "id": "legacy:malware:0a3ffd661bac67a8",
        "name": "Bladabindi",
        "slug": "bladabindi"
      },
      {
        "id": "legacy:malware:2066823fa37e1028",
        "name": "Njw0rm",
        "slug": "njw0rm"
      },
      {
        "id": "a88cf653-3ec6-40f9-84a8-ec05b54b1099",
        "name": "njRAT - S0385",
        "slug": "njrat-s0385"
      }
    ],
    "intrusion_sets": [
      {
        "id": "0928620a-570e-408b-a54d-29186041f156",
        "name": "Key Group",
        "slug": "key-group"
      }
    ],
    "attack_patterns": [
      {
        "id": "7e5fbc10-b908-4ce8-8ba8-9fd70790c6ae",
        "name": "T1562.004"
      },
      {
        "id": "d3254e3b-07e6-4420-96e0-2e107ce17712",
        "name": "T1102.001"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "c5f0558f-48a3-4714-a75c-5193d56360f9",
        "name": "T1037"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Russian Federation"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/66fd0988d2d5688769a692b8",
    "https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/"
  ]
}