Beelzebub ransomware operator 'WolfBlxck' claims full rewrite with EDR evasion and recruits developer, pentester and negotiator
An actor using the handle WolfBlxck posted an updated recruitment announcement for Beelzebub ransomware. The actor claims the malware was rewritten from scratch with a stronger focus on disabling endpoint defenses, suppressing telemetry and hindering incident response. The post seeks three more members: a developer, a penetration tester and a negotiator. Proposed target categories are hospitals, schools and universities, SMBs and local cloud providers. The post is visible in screenshots, but the malware's capabilities and the recruitment success have not been independently validated.
Technical Details
- Claimed capabilities: bypassing antivirus/EDR, terminating monitoring and analysis utilities, suppressing AMSI and ETW visibility, disabling PowerShell logging and Windows security controls.
- Claimed destructive and anti-forensic actions: removing recovery components and wiping Windows event logs and other forensic artifacts.
- Claimed to disable remote-management and network services and to restrict common administrative tools.
- Claimed persistence via Registry Run/RunOnce keys and the Startup Folder, plus propagation through removable media and network shares.
- The actor also describes internal rules on secrecy, role separation and profit-sharing.
- No malware hash, Telegram handle, attacker domain or IP address is visible in the screenshots.
- ATT&CK mappings: T1562.001, T1070.001, T1490 and T1547.001, all labeled as claimed.
Remediation
- The source offers no specific guidance. Generic hardening is advisable: protect EDR and AV with tamper protection, centrally collect and monitor AMSI, ETW, PowerShell and Windows event logs off-host, and alert on log clearing or security-tool termination.
- Keep offline, immutable backups and monitor for attempts to delete shadow copies or recovery settings.
- Restrict removable media and network share exposure.
- Healthcare, education, SMB and cloud-provider defenders should treat the announced targeting as relevant to their threat models.
Linha do tempo
-
Beelzebub ransomware operator 'WolfBlxck' claims full rewrite with EDR evasion and recruits developer, pentester and negotiator
ler a análise desta fonte ocultar
An actor using the handle WolfBlxck posted an updated recruitment announcement for Beelzebub ransomware. The actor claims the malware was rewritten from scratch with a stronger focus on disabling endpoint defenses, suppressing telemetry and hindering incident response. The post seeks three more members: a developer, a penetration tester and a negotiator. Proposed target categories are hospitals, schools and universities, SMBs and local cloud providers. The post is visible in screenshots, but the malware's capabilities and the recruitment success have not been independently validated.
Technical Details
- Claimed capabilities: bypassing antivirus/EDR, terminating monitoring and analysis utilities, suppressing AMSI and ETW visibility, disabling PowerShell logging and Windows security controls.
- Claimed destructive and anti-forensic actions: removing recovery components and wiping Windows event logs and other forensic artifacts.
- Claimed to disable remote-management and network services and to restrict common administrative tools.
- Claimed persistence via Registry Run/RunOnce keys and the Startup Folder, plus propagation through removable media and network shares.
- The actor also describes internal rules on secrecy, role separation and profit-sharing.
- No malware hash, Telegram handle, attacker domain or IP address is visible in the screenshots.
- ATT&CK mappings: T1562.001, T1070.001, T1490 and T1547.001, all labeled as claimed.
Remediation
- The source offers no specific guidance. Generic hardening is advisable: protect EDR and AV with tamper protection, centrally collect and monitor AMSI, ETW, PowerShell and Windows event logs off-host, and alert on log clearing or security-tool termination.
- Keep offline, immutable backups and monitor for attempts to delete shadow copies or recovery settings.
- Restrict removable media and network share exposure.
- Healthcare, education, SMB and cloud-provider defenders should treat the announced targeting as relevant to their threat models.