IceFire is a ransomware group active since 2022 that targets Linux systems using the IBM Aspera Faspex vulnerability.
IceFire is a ransomware group active since 2022 that expanded to Linux in early 2023 by exploiting a vulnerability in IBM Aspera Faspex (CVE-2022-47986). The group targets media and entertainment organizations in Turkey, Iran, Pakistan, and the UAE, employing double-extortion tactics. Defenders should prioritize patching CVE-2022-47986, enforce network segmentation, and monitor for data exfiltration attempts.
IceFire is a ransomware group first observed in 2022 that expanded to Linux in early 2023 by exploiting a vulnerability in IBM Aspera Faspex (CVE-2022-47986), targeting media and entertainment organizations in Turkey, Iran, Pakistan, and the UAE using double-extortion tactics.
The IceFire group exploited the CVE-2022-47986 vulnerability in IBM Aspera Faspex to expand to Linux systems in early 2023.
The IceFire group targets media and entertainment organizations in Turkey, Iran, Pakistan, and the UAE.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.