Home / Ransomware Intelligence / All groups / 0apt

0apt Ransomware

Tracked since Jan 28, 2026

victims recorded

in the last 30 days

CVEs

—

Last activity

The group appears unreliable. Most, if not all, of its alleged victims cannot be verified and appear to be randomly selected organizations. WE HAVE DECIDED TO REMOVE ENTRIES FOR THIS GROUP

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

No CVE associated with this group in the sources.

Tactics and techniques (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1133 External Remote Services T1566 Phishing T1566.001 Phishing: Spearphishing Attachment

Execution

T1047 Windows Management Instrumentation T1059.001 Command and Scripting Interpreter: PowerShell T1204.002 User Execution: Malicious File

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task T1547.001 Boot or Logon Autostart Execution: Registry Run Keys

Defense Evasion

T1014 Rootkit T1027 Obfuscated Files or Information T1036 Masquerading T1055 Process Injection T1070 Indicator Removal T1140 Deobfuscate/Decode Files or Information T1562.001 Impair Defenses: Disable or Modify Tools T1564 Hidden Artifacts T1622 Debugger Evasion T1672 Email Spoofing T1678 Delay Execution

Credential Access

T1003 OS Credential Dumping T1003.001 OS Credential Dumping: LSASS Memory T1555 Credentials from Password Stores

Discovery

T1082 System Information Discovery T1083 File and Directory Discovery T1135 Network Share Discovery T1526 Cloud Service Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1570 Lateral Tool Transfer

Collection

T1005 Data from Local System T1039 Data from Network Shared Drive T1056 Input Capture T1119 Automated Collection T1560 Archive Collected Data

Exfiltration

T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service

Command and Control

T1071.001 Application Layer Protocol: Web Protocols T1573 Encrypted Channel

Impact

T1485 Data Destruction T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live