ransomcortex

Executive Summary

RansomCortex is a newly emerged ransomware group targeting healthcare facilities globally. The threat actor has demonstrated rapid operational tempo, attacking four victims within days of its first appearance, with initial activity focused on Brazil and Canada. While the group appears to be small and niche, it poses a significant risk to critical healthcare infrastructure due to its focus on disruption and financial gain through ransomware.

Goals & Targeting

RansomCortex’s primary goals are organizational disruption and financial gain through the deployment of ransomware. The group appears focused on healthcare facilities, likely due to their high sensitivity to downtime, critical nature of services, and potential willingness to pay ransoms quickly. The targeting of Brazil and Canada in its initial campaigns suggests either regional expertise or a language-aligned operational focus.

RansomCortex emerged in July 2024 as a medium-sophistication criminal threat actor specializing in ransomware operations. The group has rapidly targeted healthcare facilities, with four confirmed victims across Brazil and Canada within the first week of its activity. This suggests a high level of专注于 targeting critical infrastructure sector and geographically dispersed but language-aligned regions. Despite being a relatively small and niche operation, RansomCortex has displayed technical proficiency in deploying ransomware effectively to disrupt operations and extort payments from its targets.

Key Capabilities

• Ransomware deployment
• Quick-strike campaign tactics
• Focused geographic targeting
• Email-based phishing attacks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

RansomCortex’s early campaigns have been characterized by quick strike operations, suggesting an emphasis on rapid victimization and monetization. The group appears to target healthcare facilities specifically, with a focus on Brazil and Canada as initial geographic targets. While the actor is relatively new, its ability to compromise multiple victims quickly indicates a level of operational maturity beyond its small size. Notable past operations include four confirmed attacks within the first week of activity in July 2024.

IOC Patterns

• Spear-phishing emails targeting healthcare employees
• Distribution of macro-laced Office documents
• File encryption with unique ransom notes
• Encrypted communication channels for C2

Recommended Actions

• Implement strict email filtering and phishing detection solutions.
• Enhance endpoint detection and response (EDR) capabilities to detect and block known ransomware behaviors.
• Encrypt critical data backups and ensure they are isolated from network access.
• Conduct regular employee training on identifying suspect emails and attachments.
• Monitor for signs of lateral movement and file encryption activities across the network.

Suggested Tags