0APT ransomware
0apt_ransomware, commonly referred to in the provided reporting as 0APT, is a ransomware operation assessed by Cyderes Howler Cell to be an active ransomware-as-a-service (RaaS) platform with a working affiliate model. Although some researchers, including GuidePoint Security, assessed the group may have been a fake gang using other criminals’ stolen data, Cyderes reported that it accessed the group’s RaaS portal, collected malware samples, and determined the ransomware payloads were viable, functional, and ready for deployment. The ransomware was described as a legitimate encrypter emphasizing reliability, operator configurability, and secure cryptographic implementation, with characteristics aligning with broader Rust-based ransomware trends. No specific infection vector, victimology, targeted industries, platforms, or indicators of compromise were provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cyderes has managed to get its hands on the group's actual ransomware, and it's apparently a legit encrypter.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Impact
1 technique
Impact
"The platform allowed affiliates to generate five ransomware samples per account... These samples utilized encryption algorithms including AES256, Salsa20/ChaCha, and the rare Speck cipher... Generated ransomware appends the .0apt extension and drops README0apt.txt"
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RaaS ransomware payload described as reliable and configurable, with secure cryptographic implementation and aligned with modern Rust-based ransomware development trends.
Ransomware referenced as a functional file-encrypting payload ('legit encrypter') after prior claims of fake victim listings.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.