« Todas las amenazas

0mega

0mega is a ransomware group first observed in May 2022, operating with a double extortion model: <br/>* Encrypting victim files (adding the .0mega extension) <br/>* Threatening to leak stolen data if ransom demands are not met. <br/>Ransom notes are named DECRYPT-FILES.txt and include victim-specific details and a Tor-based negotiation portal. <br/>Unlike typical Ransomware-as-a-Service (RaaS) operations, 0mega appears to work as a closed group, selecting a limited number of high-value targets. <br/>The group employs two main tactics: <br/>* Traditional ransomware encryption of on-premise systems. <br/>* Cloud-based extortion, compromising Microsoft 365 Global Admin accounts, creating unauthorized admin users, and exfiltrating data via SharePoint. <br/>Active period: May 2022 – January 2024

Las reivindicaciones las publican los propios grupos criminales y no están verificadas hasta que la organización o la prensa las confirman. Los nombres de personas físicas (autónomos, profesionales individuales) se anonimizan conforme al RGPD. Nunca enlazamos a sitios de filtración ni a datos robados. Para solicitar la retirada o anonimización de una entrada, contacte con el administrador del sitio.

Fuentes: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.