Ransomexx ransomware

Who Ransomexx is

RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.

Recorded activity

Disclosures attributed to Ransomexx in this database run from April 2024 to June 2026, totalling 24 victims — 0.1% of everything tracked here. Ransomexx has listed victims in 17 countries in this database, most often United States, followed by India and Japan. The sectors appearing most in its listings are Business Services, Technology, Healthcare.

Tooling observed in Ransomexx operations

• LaZagne
• Mimikatz
• ProcDump
• BCDEdit
• Cobalt Strike

Software reported in use by Ransomexx. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

Indicators of compromise

• [email protected]

Showing a sample of 1 EMAIL on file. Hashes and network indicators published for Ransomexx. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
RansomEXX / Defray777 ransomware
*/

rule RansomEXX_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.ransomexx"
        description = "Detects RansomEXX ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "RansomEXX" ascii nocase
        $s2 = "RANSOM_NOTE.txt" ascii nocase
        $s3 = ".ransom" ascii nocase
        $s4 = "Defray777" ascii nocase

    condition:
        any of them
}

rule RansomEXX_PE
{
    meta:
        author = "ransomware.live"
        family = "ransomware.ransomexx"
        description = "Detects RansomEXX ransomware executable"
        date = "2026-05-04"
        severity = 9
        score = 90

    strings:
        $s1 = "RansomEXX" ascii wide
        $s2 = "Defray777" ascii nocase
        $s3 = "/proc/sys/vm/drop_caches" ascii

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and 2 of them
}

Community-contributed rules for Ransomexx, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.