Rancoz is a Vice Society copycat Windows ransomware appending .rec_rans extension and linked to Buddy ransomware.
Rancoz is a Windows-targeting ransomware strain observed since November 2022, considered a Vice Society copycat using double extortion tactics against a small number of organizations. It appends the '.rec_rans' extension to encrypted files and is linked to the same developer as the 'Buddy' ransomware. Defenders should monitor for suspicious PowerShell execution and C2 communications while checking for data exfiltration channels.
Rancoz is a Windows-targeting ransomware strain first observed in November 2022 that appends the ".rec_rans" extension to encrypted files, considered a Vice Society copycat, deployed against a small number of organizations using double extortion and linked to the same developer as the "Buddy" ransomware.
Rancoz is a ransomware strain that targets Windows systems.
Rancoz appends the '.rec_rans' extension to encrypted files.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.