0mega

Executive Summary

0mega is a medium‑sophistication criminal ransomware group that first emerged in mid‑2022. They employ double‑extortion tactics, combining on‑prem encryption with data exfiltration and publication threats to increase ransom leverage. Their reach spans high‑value sectors such as finance, defense, and critical infrastructure across the US, UK, and Australia.

Goals & Targeting

0mega seeks to maximize monetary gain by monetizing data theft and file encryption. Their strategic objective is to pressure victims through the dual threat of data exposure and system compromise, thereby forcing payment before the released material jeopardizes reputational or regulatory standing. The actor selectively targets organizations with high-value data, public visibility, or critical operational roles—especially within finance, defense, media, food‑agriculture, manufacturing, and energy sectors in the US, UK, and Australia—to exploit higher ransom expectations and potential for wider impact. By extending attacks into cloud platforms, 0mega increases its attack surface, allowing access to tenant identities, privileged accounts, and inter‑tenant data. This focus on identity infrastructure also raises their prospects of establishing persistence through compromised admin users, thereby enabling lateral movement without detection. The group’s emphasis on double‑extortion rather than single‑extortion illustrates a shift toward more sophisticated extortion models that leverage public exposure to magnify ransom pressure and incentivize faster payment, further aligning with their purely financial objectives. Key capabilities: The actors utilize phishing, credential dumping (Mimikatz, LaZagne), exploitation of public services, MFA manipulation, WMI usage, scheduled tasks for persistence, registry modifications to bypass UAC, rootkits for stealth, obfuscation via packing & dynamic API resolution, RClone for exfiltration, disabling Windows Defender, clearing logs and shadow copies, cloud compute instance creation/deletion, bulletproof hosting, DDoS (via botnets), MiTM attacks, LLMNR poisoning, and use of PsExec for lateral movement. They also leverage group policy changes to embed malicious code across domains.

Key Capabilities

• Phishing campaigns with credential harvesting
• Credential dumping via Mimikatz, LaZagne, WebBrowserPassView
• Exploitation of public-facing applications (T1190)
• MFA manipulation and account hijacking
• WMI execution for persistence
• Scheduled task creation/modification for autonomous execution
• Registry modifications to bypass UAC and inject cmd.exe
• Rootkit installation for stealth
• Binary obfuscation through packing & dynamic API resolution
• Disabling Windows Defender with defoff.bat
• Clearing event logs, shadow copies, registry keys
• Data exfiltration using RClone and third‑party cloud services
• Double‑extortion (encryption + data theft threat)
• Bulletproof hosting infrastructure for malware distribution
• DDoS via botnets
• Man‑in‑the‑Middle attacks on communications
• LLMNR/NBT-NS poisoning for local adversary movement
• Use of PsExec for lateral movement over SMB/ RDP
• Group Policy modifications to spread malicious code
• Automated cloud compute instance creation/deletion

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

0mega’s operations surface annually since July 2022, with confirmed incidents in Q3 2022 against a high‑profile victim. The group targets large organizations that can afford sizable ransom payments and where data exposure would cause significant reputational damage. 0mega exhibits a consistent double‑extortion methodology: encrypt files, exfiltrate data, threaten public release, then demand payment—typically within 14–30 days of infection. Operational tempo is moderate to high: multiple campaigns appear per quarter and show geographic spread primarily across the US, UK, and Australia. The actors adapt swiftly by shifting from pure on‑prem attacks to cloud‑centric tactics such as Microsoft 365 admin credential compromise and dynamic cloud instance creation/deletion. Notable previous operations include a 2022 ransomware incident detailed in an academic report where victims endured both encryption and data leakage, and a 2024 advisory citing bulletproof hosting usage for malware delivery. National security agencies have placed the group on their watch list for its potential impact on critical infrastructure.

IOC Patterns

• malicious batch defoff.bat disabling Windows Defender
• registry modifications bypassing UAC and injecting cmd.exe
• exfiltration via RClone cloud service
• bulletproof hosting domains
• phishing domain infrastructure
• malicious email attachments with names resembling legitimate software
• brute‑force login attempts on authentication services

Recommended Actions

• Block or mitigate bulletproof hosting providers used for malware distribution
• Apply OFAC sanctions and asset freezes against identified hosting operators (Medialand LLC, ML.Cloud)
• Implement proactive blocked domains lists updated from threat feeds for known phishing infrastructure
• Deploy endpoint detection that specifically alerts for defoff.bat execution and Windows Defender disablement scripts
• Enable monitoring of new or modified Scheduled Tasks and WMI execution requests to catch persistence attempts
• Enforce code signing validation for all executable/PowerShell scripts within the corporate environment
• Monitor registry changes that affect UAC, Group Policy objects, and security settings
• Detect credential dumping techniques (LSASS memory reads, SAM access) with behavioral sensors
• Restrict untrusted RDP/SMB connections and enforce MFA everywhere
• Deploy a cloud resource change tracker that alerts on new instance creation or deletion across Azure/AWS/GCP
• Integrate phishing detection solutions based on malicious email indicators such as known sending domains and attachment patterns
• Conduct regular security awareness training focusing on spear‑phishing and double‑extortion scenarios

Suggested Tags