Obscura ransomware multi-host deployment via NETLOGON
Malware Activity
Summary
Hide ▲
Show ▼
The Obscura ransomware was observed executing across multiple hosts, increasing the risk of broad network-wide encryption and recovery disruption. It was staged through the NETLOGON share and a scheduled task, showing how the malware was being deployed inside the environment. The binary also kills security and backup tools and runs vssadmin delete shadows /all /quiet to undermine restoration.
Related Happenings
Medusa ransomware post-compromise deployment
Malware Activity
First: 07.04.2026 09:35
Last: 07.04.2026 09:35
Sources 1
About this happening:
**Medusa ransomware** is being deployed rapidly after initial access, turning intrusions into fast-moving extortion events and shrinking defenders' response time. The malware acti...
Medusa ransomware post-compromise deployment
Malware ActivityAbout this happening: **Medusa ransomware** is being deployed rapidly after initial access, turning intrusions into fast-moving extortion events and shrinking defenders' response time. The malware acti...
Obscura ransomware reverse engineering and execution analysis
Technical Analysis
First: 24.09.2025 17:01
Last: 24.09.2025 17:01
Sources 1
How related:
When the binary is launched, it will check the status of an environment variable called DAEMON.
About this happening:
Researchers reverse-engineered **Obscura ransomware**, exposing its **DAEMON** execution gate, admin-only checks, process-killing routine, and encryption flow. The findings improv...
Obscura ransomware reverse engineering and execution analysis
Technical AnalysisHow related: When the binary is launched, it will check the status of an environment variable called DAEMON.
About this happening: Researchers reverse-engineered **Obscura ransomware**, exposing its **DAEMON** execution gate, admin-only checks, process-killing routine, and encryption flow. The findings improv...
Timeline
-
24.09.2025 17:01 2 articles · 8mo ago
Obscura ransomware executes across multiple hosts
Exploitation ObservedObscura ransomware was observed executing across multiple hosts on a victim organization’s network on a domain controller, with the binary staged through the NETLOGON share and a SystemUpdate scheduled task used to launch it. A separate scheduled task on one user machine enabled Remote Desktop Protocol access through the Windows firewall, and the malware attempted to run cmd.exe /c vssadmin delete shadows /all /quiet to hinder recovery.
Show sources
- Obscura, an obscure new ransomware variant — www.bleepingcomputer.com — 24.09.2025 17:01
- Obscura, an obscure new ransomware variant — www.bleepingcomputer.com — 24.09.2025 17:01
-
24.09.2025 17:01 1 articles · 8mo ago
Huntress identifies a previously unseen Obscura ransomware variant
Initial DisclosureHuntress identified a previously unseen ransomware variant called Obscura on a victim organization’s domain controller, found no public references to the family, and noted that limited Huntress agent deployment reduced detection and response visibility. The ransom note name README_Obscura.txt and the Obscura references in the note tied the sample to the new family name.
Show sources
- Obscura, an obscure new ransomware variant — www.bleepingcomputer.com — 24.09.2025 17:01