Underground ransomware is a double-extortion operation linked to Russia-based RomCom group exploiting CVE-2023-36884.
Underground ransomware is a criminal operation deployed by the Russia-based RomCom group (Storm-0978), active since July 2023. It targets companies across multiple industries by exploiting CVE-2023-36884 to gain initial access. Key TTPs include encrypting files without changing extensions, deleting Volume Shadow Copies and Windows event logs, and conducting double-extortion campaigns. Defenders should prioritize patching CVE-2023-36884, maintaining secure offline backups, and monitoring for suspicious PowerShell and shadow copy deletion activity.
Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.
They primarily exploit CVE-2023-36884 to gain initial access.
They encrypt files without changing the file extensions.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.