Epsilon Red

Epsilon Red is a ransomware family first observed in 2021. It was identified by Sophos as a Go-based ransomware used as the final payload in a hand-controlled intrusion against a U.S. hospitality organization. In that intrusion, the attackers likely gained initial access through an unpatched Microsoft Exchange server, potentially via the ProxyLogon exploit chain, then used WMI to deploy tooling and execute a PowerShell orchestrator named RED.ps1 across reachable Windows hosts. RED.ps1 unpacked a 7z archive into system32, created scheduled tasks to run multiple scripts, and prepared systems for encryption by deleting shadow copies, clearing Windows event logs, disabling protections including Windows Defender, killing processes and services associated with security, backup, database, and business software, and modifying Windows Firewall rules to block most inbound TCP ports while leaving 3389/TCP and 5650/TCP open. The intrusion also involved installation of Remote Utilities and Tor Browser, and Sophos assessed an ancillary p.exe binary as a custom-compiled version of the open-source EventCleaner tool.

The ransomware payload, RED.exe, is a 64-bit Windows executable written in Go, compiled with MinGW, and packed with a modified UPX runtime packer. It uses code from the open-source godirwalk project to enumerate directories and encrypt subfolders in parallel by spawning child processes. It does not make network connections itself and relies on the surrounding PowerShell tooling for preparatory actions. Encrypted files are appended with the .epsilonred extension, and a ransom note is dropped in each folder. Victims were directed to communicate with the operators via the clearnet site epsilons[.]red. Sophos reported the ransom note resembles REvil’s styling, but noted no other obvious similarities beyond that. Based on a cryptocurrency address in the ransom note, Sophos linked at least one victim payment of 4.29 BTC on May 15.

More recent reporting links Epsilon Red to ClickFix-style delivery infrastructure. CloudSEK identified a ClickFix-themed malware delivery site associated with Epsilon Red ransomware activity in which victims were redirected to a secondary page using ActiveXObject("WScript.Shell") to silently execute Windows shell commands. The observed script changed to %userprofile%, downloaded a payload from http://155.94.155[.]227:2269/dw/vir.exe via curl, saved it as a.exe, executed it hidden, and displayed a fake verification message as social-engineering cover. CloudSEK reported related infrastructure impersonating Discord Captcha Bot and services such as Kick, Twitch, Rumble, and OnlyFans, and identified delivery domains including twtich[.]cc and capchabot[.]cc. Reported indicators include MD5 98107c01ecd8b7802582d404e007e493 for an Epsilon Red sample, the payload-hosting/C2 endpoint 155.94.155[.]227:2269, and 213.209.150[.]188:8112. Separate reporting also noted Discord was spoofed in July 2025 for Epsilon Red ransomware distribution.