Gridinsoft Team

Slopsquatting is an emerging type of software supply chain attack that leverages AI hallucinations to compromise development environments. This attack vector exploits the tendency of large language models (LLMs) to recommend non-existent package names, which attackers then register and weaponize.…

TROX Stealer is a sophisticated information-stealing malware first identified in December 2024, distributed as a Malware-as-a-Service (MaaS) offering. This multi-stage threat employs complex evasion techniques, including WebAssembly (Wasm) and multiple programming languages, to steal sensitive data ranging from browser credentials…

LegionLocker is a dual-purpose ransomware and screen locker that deploys multiple persistence mechanisms while encrypting files and locking access to the system. This malware communicates through Telegram, requiring victims to contact the operators via the @xexeza handle to negotiate ransom…

NBA Ransomware employs double extortion tactics by encrypting files with the .NBA extension and exfiltrating sensitive data. This malware establishes communication through qTox, requiring victims to install the secure messaging application to negotiate ransom payments. First detected in early 2025,…

Solara Ransomware is a threat that combines encryption capabilities with social engineering tactics targeting gaming communities, particularly ROBLOX users. This malware variant, associated with the Chaos ransomware family, disguises itself as a gaming utility while deploying file encryption functionality. First…

Krypt Ransomware employs double extortion tactics by both encrypting files and claiming to steal sensitive data. This malware establishes communication through multiple channels including a TOR-based chat interface, email, and Telegram. First observed in early 2025, Krypt targets organizations and…

Maximsru Ransomware represents a significant threat that encrypts victim files and appends a random five-character extension to filenames. This malicious program establishes persistence through desktop wallpaper modification and creates a distinctive ransom note titled “MAXIMSRU.txt”. First identified through submissions to…

Jeffery Ransomware represents a dangerous threat that emerged in early 2020, exploiting COVID-19 pandemic fears to distribute malware that encrypts victims’ files with the distinctive .Jeffery extension. This ransomware combines opportunistic social engineering with effective encryption techniques, establishing persistence through…

VerdaCrypt represents a PowerShell-based ransomware that combines advanced encryption techniques with psychological manipulation to extort victims. Employing a modular architecture with anti-analysis capabilities, this ransomware targets critical data across multiple file types with AES-256 encryption. The threat actor behind VerdaCrypt,…

Sauron Ransomware represents a sophisticated cyberthreat that combines file encryption, data theft, and psychological manipulation to extort victims. Named after the dark lord from J.R.R. Tolkien’s works, this ransomware employs a triple-extortion strategy demanding payment through Telegram. With unique characteristics…