Cicada3301 ransomware

Who Cicada3301 is

Cicada3301 is a ransomware-as-a-service group (tracked as Repellent Scorpius by Palo Alto) that emerged in mid-2024 using Rust-based ransomware targeting Windows, Linux, and ESXi systems, suspected to be a successor of BlackCat/ALPHV and running an affiliate program with 20% commissions.

Recorded activity

Disclosures attributed to Cicada3301 in this database run from June 2024 to September 2025, totalling 75 victims — 0.3% of everything tracked here. Cicada3301 has listed victims in 15 countries in this database, most often United States, followed by United Kingdom and Canada. The sectors appearing most in its listings are Business Services, Technology, Manufacturing.

Tooling observed in Cicada3301 operations

• EDRSandBlast
• ADRecon
• PowerView
• SoftPerfect NetScan
• RClone
• BCDEdit
• PsExec
• WMIC
• GOST
• Plink
• PowerSploit
• Rubeus

Software reported in use by Cicada3301. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

YARA detection rules

/*
CICADA3301 ransomware (Rust, ESXi)
*/

rule Cicada3301_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.cicada3301"
        description = "Detects CICADA3301 ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "CICADA3301" ascii nocase
        $s2 = "RECOVER-" ascii
        $s3 = "cicada3301" ascii nocase
        $s4 = "cicada.onion" ascii nocase

    condition:
        any of them
}

rule Cicada3301_PE
{
    meta:
        author = "ransomware.live"
        family = "ransomware.cicada3301"
        description = "Detects CICADA3301 ransomware binary"
        date = "2026-05-04"
        severity = 9
        score = 90

    strings:
        $s1 = "CICADA3301" ascii wide
        $s2 = "esxi" ascii nocase
        $s3 = "vim-cmd" ascii

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and 2 of them
}

Community-contributed rules for Cicada3301, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.