Hotarus is a ransomware group active since 2021, targeting South American financial and government entities with PHP-based ransomware.
Hotarus is a ransomware group active since 2021, known for deploying PHP-based ransomware to target financial and government entities. They primarily focus on large financial institutions and government bodies in South America. Key TTPs include PHP ransomware deployment and large-scale data theft; defenders should monitor for anomalous PHP script execution. Pay special attention to web server logs for suspicious file creation, signs of mass data exfiltration, and placement of ransomware notes.
Hotarus Corp is a ransomware group that came to attention in early 2021 after attacking Ecuador's Ministry of Finance and Banco Pichincha — the country's largest private bank — deploying PHP-based ransomware and claiming to have stolen tens of millions of customer records.
Hotarus primarily targets financial institutions and government bodies located in South America.
Hotarus uses PHP-based ransomware in their operations.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.