Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started
Threat Actors emperador

emperador

TLP:CLEAR
Active
Kill Chain Analysis Generate Graph Hunt Package

Also known as: DeputyDog, Emperador Oscuro Marble, Emperador Dark, Royal Ransomware, BlackCat, Gookee, kapuchin0, Guki, leaked the source code, shut the operation down, UAS-TeNT

Description

Known victims: 1

Goals & Targeting

Objectives

Ransomware
Financial Gain

Targeted Sectors

Financial services
Government
Telecommunications
Healthcare
Defense
Education
Critical infrastructure
Manufacturing
Retail
Media
Entertainment
Non profit
Information technology
Hospitality
Utilities
Aerospace
Maritime
Nuclear
Gaming
Food agriculture
Construction
Transportation
Pharmaceutical

Targeted Countries / Regions

UA
IN
CN
RU
GB
US
DE
KP
IR
PK
BY
PL
TW
CA
AU

AI Analysis

No AI analysis yet.

ATT&CK Techniques

Command & Control
1 technique
T1071.001

Web Protocols
Defense impairment
1 technique
T1112

Modify Registry
Persistence
1 technique
T1133

External Remote Services
Reconnaissance
1 technique
T1595.002

Vulnerability Scanning
Resource Development
1 technique
T1608.001

Upload Malware

Observed Data

No observed data linked yet.

Indicators of Compromise

View all →
Filename 12 Email Address 1 Domain 4 IPv4 Address 1 SHA-256 Hash 2
Filename 12
EN.pdf
50% TLP:CLEAR
6202033.vbs
50% TLP:CLEAR
NIHPP2025.04.23.650151v2-supplement-1.pdf
50% TLP:CLEAR
wt.exe
50% TLP:CLEAR
ld.py
50% TLP:CLEAR
package.json
50% TLP:CLEAR
setup.js
50% TLP:CLEAR
roboform-x64.dll
50% TLP:CLEAR
RoboTaskBarIcon.exe
50% TLP:CLEAR
syncappw.exe
50% TLP:CLEAR
nView64.dll
50% TLP:CLEAR
FmApp.exe
50% TLP:CLEAR
Email Address 1
ifstap@proton.me
50% TLP:CLEAR
Domain 4
Philstar.com
50% TLP:CLEAR
packages.npm.org
50% TLP:CLEAR
package.md
50% TLP:CLEAR
Preprints.org
50% TLP:CLEAR
IPv4 Address 1
142.11.206.73
50% TLP:CLEAR
SHA-256 Hash 2
aa1233393dded792b74e334c50849c477c4b86838b32ef45d6ab0dc36b4511e3
50% TLP:CLEAR
41128b82fa12379034b3c42bdecf8e3b435089f19a5d57726a2a784c25e9d91f
50% TLP:CLEAR
Open in full Indicators list →

References

  1. unit42.paloaltonetworks.com — Cited by web research for: Royal Ransomware
  2. pmc.ncbi.nlm.nih.gov — Cited by web research for: UAS-TeNT
  3. www.trendmicro.com — Cited by web research for: T1059.005
  4. www.trendmicro.com — Cited by web research for: Payload

Intel Summary

22

Techniques

40

Tools

1

Campaigns

40

IOCs

0

Observed Data

11

Tactics

Details

Type
Criminal
Sophistication
Medium
Primary Motivation
Organizational gain
Country of Origin
Iran (IR)
Confidence
80%
First Seen
Aug 10, 2026
Last Seen
Aug 10, 2026
Added
Aug 12, 2026
Notes
0
Log in to add a note
No notes yet. Click "Add Note" to create the first analysis note.
Opinions
0
Log in to add an opinion
No opinions yet. Be the first to assess this intelligence.
Leaving Threaticon

This link opens an external site that isn't part of the platform.