gammax

Executive Summary

Gammax is a medium‑sophistication ransomware-as-a-service collective that emerged in late 2025 and has aggressively targeted commercial and critical infrastructure entities across the Middle East, North America, and Europe. They employ a double‑extortion model—encrypting data while simultaneously leaking stolen files via a TOR‑hosted leak site or third‑party broker sites—to pressure victims into paying. The group’s rapid post‑exfiltration leak tactics, combined with AI‑driven development of custom payloads, have led to high‑impact breaches in the financial, healthcare, and energy sectors.

Goals & Targeting

The strategic objective of Gammax is purely financial: acquire ransom payments and monetise stolen data. The actor concentrates on corporate entities across finance‑services, healthcare, construction, manufacturing, transportation, government, energy, utilities, oil‑gas, hospitality, defense, critical infrastructure, education, telecommunications, and retail sectors. Victims are selected for the richness of personal or commercial records they hold—such as customer databases, financial ledgers, or proprietary designs—making data breach plus ransomware a two‑pronged incentive. The geographic spread—including Saudi Arabia, United States, Pakistan, Canada, Australia, Brazil, France, Israel, Iran, and Russia—suggests opportunistic targeting based on market attractiveness rather than clear geopolitical focus. In short, Gammax seeks to extort maximum value from entities that can pay quickly, leveraging both encryption pressure and reputational damage to compel payment.

Key Capabilities

• Spear‑phishing with malicious links
• Exploitation of Remote Desktop Services for initial access
• Deployment of backdoor trojans for persistence
• Credential dumping via custom malware
• Rapid data exfiltration scripts
• Custom ransomware engine using unique file extensions (.vanhelsing, .vanlocker)
• Double‑extortion leak sites on Tor hidden services
• Use of Tox P2P protocol for command and control
• AI‑driven development of malicious payloads
• Dissemination of stolen datasets via public broker sites (DarkFeed, ransom.live)

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Gammax first surfaced in late 2025, with its earliest confirmed attack reported against MTCO (Saudi Arabia) and subsequent incidents including RE/MAX 1st Choice (Florida) and AguAseo (Panama). The group appears to ramp up activity rapidly: initial infiltration, quick data exfiltration, encryption, and immediate leak of stolen files. Victims often fall within mid‑sized corporations that lack robust incident response capabilities. While the overall operational tempo is moderate—about a handful of attacks per month—the actor demonstrates consistent use of its double‑extortion framework across varied sectors and geographies. No confirmed attribution to any nation state has emerged, with publicly available evidence pointing toward a purely commercial cybercriminal operation. Future campaigns are likely to continue leveraging spear‑phishing emails or RDP exploits, aiming at data‑rich corporate clients and maintaining the release of exfiltrated files on public broker sites to pressure payment. Gammax’s infrastructure remains largely anonymous but is known to use fast‑flux DNS for leak sites and Tox P2P for C2. Overall, the group’s pattern reflects a professional ransomware operation that balances sophisticated malware development with opportunistic target selection to maximize financial return.

IOC Patterns

• Spear‑phishing emails with malicious links
• Exploitation of Remote Desktop Services vulnerabilities
• Use of Tox peer‑to‑peer protocol for command and control

Recommended Actions

• Deploy multi‑factor authentication on all remote desktop services and enforce strong, unique passwords.
• Regularly patch known RDP CVEs (e.g., MS17‑010) and consider disabling or hardening RDP if not essential. "",
• Implement email filtering and advanced threat protection to block spear‑phishing payloads.
• Enable network monitoring and alerting for unusual outbound traffic patterns indicative of data exfiltration or connection to Tor/C2 nodes.
• Maintain offline, immutable backups and test restoration procedures before encrypting data in situ.
• Educate employees on phishing recognition and conduct regular security awareness training. "",
• Apply strict least‑privilege policies and monitor privileged account usage for anomalies.
• Use host‑based detection systems that flag unauthorized trojan persistence mechanisms. "
• Set up a dedicated leak site monitoring service to receive early warnings of data exposures from broker sites like DarkFeed, ransom.live, etc.