Share on LinkedInShare on LinkedIn

ARTICLE · 11 JULY 2024

Ankura CTIX FLASH Update - July 9, 2024

Researchers at Group-IB have identified a new Ransomware-as-a-Service (RaaS) operator dubbed "Eldorado" after posing as a potential affiliate to gain access to the Eldorado encryptor.

United StatesTechnology

Malware Activity

New Eldorado Ransomware-as-a-Service Emerges

Researchers at Group-IB have identified a new Ransomware-as-a-Service (RaaS) operator dubbed "Eldorado" after posing as a potential affiliate to gain access to the Eldorado encryptor. Promotion of the Eldorado RaaS was first observed in March 2024, when an advertisement of the ransomware was posted on the popular dark web forum "RAMP". Based on Eldorado's data leak site, sixteen (16) companies have been attacked so far, most of which are based in the USA. Group-IB's analysis of the encryptor determined the ransomware is not based on previous builders, suggesting that Eldorado is not an offshoot of an existing ransomware group. Eldorado is written Golang, which is known for being versatile across platforms. The ransomware is available in four (4) formats targeting Windows OS and VMware ESXi hypervisors. The builder for the ransomware needs either domain administrator credentials or the NTLM hash for

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from