CVE Intelligence
Home / Ransomware Intelligence / All groups / underground

underground Ransomware

🔔 Create alert

Tracked since May 1, 2024

0
victims recorded
0
in the last 30 days
1
CVEs
—
Last activity

Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

  • CVE-2023-36884 High · 7.5 KEV Microsoft Windows Search Remote Code Execution Vulnerability

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live