Metaencryptor ransomware

Who Metaencryptor is

MetaEncryptor is a ransomware group first observed in mid-2023, targeting medium-to-large enterprises in legal, technology, logistics, manufacturing, and finance sectors primarily in the UK, Europe, and Southeast Asia, using AES-256/RSA-2048 encryption and double extortion.

Recorded activity

Disclosures attributed to Metaencryptor in this database run from May 2024 to October 2026, totalling 55 victims — 0.2% of everything tracked here. Metaencryptor has listed victims in 8 countries in this database, most often United States, followed by Germany and Japan. The sectors appearing most in its listings are Manufacturing, Healthcare, Technology.

Indicators of compromise

• 176.97.114.92
• 89.46.235.116

Showing a sample of 2 IP on file. Hashes and network indicators published for Metaencryptor. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
metaencryptor ransomware
*/

rule metaencryptor_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.metaencryptor"
        description = "Detects metaencryptor ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "metaencryptor" ascii nocase
        $name2 = "METAENCRYPTOR" ascii
        $onion  = "metaencryptor.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Metaencryptor, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.