M3rx is a small ransomware group active since 2025, known for using AES encryption primarily.
M3rx is a small ransomware group first observed in 2025. They primarily target Professional Services, Manufacturing, and Technology sectors across the US, Germany, Brazil, and Australia. Their main TTP involves AES-CTR/AES-GCM encryption and they have claimed around eight victims so far. Defenders should focus on ransomware prevention measures and monitor for encryption-related TTPs targeting these specific industries.
M3rx is a small ransomware group first observed in 2025, using AES-CTR/AES-GCM encryption and targeting organizations in England, the US, Australia, Germany, Italy, and Switzerland, with around eight claimed victims including a Sydney-based property firm.
M3rx primarily targets Professional Services, Manufacturing, and Technology sectors.
The group uses AES-CTR/AES-GCM encryption methods.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.