prometheus
Ransomware written in .NET, apparently derived from the codebase of win.hakbit (Thanos) ransomware.
source: ransomware.live1 refs →
prometheus
Prometheus is a crime-motivated group deploying .NET ransomware derived from the Win.hakbit (Thanos) codebase.
Analyst brief
Prometheus is a crime-motivated ransomware group, presumably targeting organizations across various sectors. Their key TTP involves deploying .NET ransomware derived from the Win.hakbit (Thanos) codebase. Defenders should focus on detecting abnormal .NET assembly execution and potential abuse of PowerShell or WMI to prevent this ransomware from encrypting systems.
crime
FAQ2
What is the primary TTP of the Prometheus ransomware group?
Their key TTP involves deploying .NET ransomware derived from the Win.hakbit (Thanos) codebase.
What activities should defenders monitor to prevent the spread of Prometheus ransomware?
They should focus on detecting abnormal .NET assembly execution and potential abuse of PowerShell or WMI.
See also4
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.