Morpheus
Morpheus is a ransomware operation observed in 2025 and 2026. Reporting links it to ransomware attacks against a South Korean plating company and to the alleged theft of more than 680 GB of data from HDFC Asset Management Company (HDFC AMC), after which the Bombay High Court issued a temporary injunction to prevent the group from publishing or disclosing the stolen information. Dragos listed Morpheus among new or emerging ransomware groups observed in Q1 2025. SentinelLABS reported that HellCat and Morpheus were essentially two distinct ransomware brands deploying identical payloads, indicating rebranding or shared tooling that complicates attribution. Based on the provided content, Morpheus is a financially motivated cybercriminal ransomware actor; no high-confidence nation-state attribution is stated. Known alias in the provided content: morpheus.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
Where they target
Geographies tied to known operations.
- 🇮🇳 India
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Allegedly conducted a ransomware-related data theft incident against HDFC Asset Management Company and claimed to have extracted more than 680 GB of critical company data, with threatened publication or disclosure of the stolen information.
Android spyware observed abusing Accessibility workflows to enable Developer options, turn on wireless debugging, and locally pair with adbd. The content explicitly states Morpheus did not use CVE-2026-0073, but it automated the prerequisite device state relevant to the vulnerability.
Reported to have conducted a ransomware attack against a South Korean plating company.
A ransomware operation sharing codebase with HellCat, part of the trend of commoditized and rebranded ransomware in the RaaS ecosystem.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.