Makop

Makop is a human-operated ransomware family active since around 2020 and commonly assessed as a Phobos-derived ransomware-as-a-service variant. It primarily targets Windows environments and has been observed compromising organizations through exposed Remote Desktop Protocol services, including brute-force and dictionary attacks against weak credentials, as well as through spearphishing campaigns delivering malicious attachments. Makop activity has affected organizations in multiple regions, including South Korea, India, Brazil, Germany, Europe, and Italy, and has also been reported against critical infrastructure such as water and wastewater entities.

Makop intrusions typically involve substantial hands-on-keyboard post-compromise activity before encryption. Operators stage a toolkit of legitimate and custom utilities for network discovery, credential access, lateral movement, privilege escalation, persistence, and defense evasion. Observed tooling includes scanners and administrative utilities, credential theft tools such as Mimikatz, LaZagne, and NirSoft utilities, remote execution via PsExec, and process-termination or deletion tools such as Process Hacker and IOBit Unlocker. Makop operators have also used custom .NET tools including ARestore, which generates and tests local Windows credential combinations, and PuffedUp, which establishes persistence. Recent reporting also describes use of GuLoader to deliver additional payloads, including Makop, marking an evolution from earlier direct deployment patterns.

Defense evasion and privilege escalation are prominent in Makop operations. Operators have disabled Microsoft Defender, attempted to uninstall security products, and abused bring-your-own-vulnerable-driver techniques to gain kernel-level capability and interfere with endpoint defenses. Multiple Windows local privilege escalation exploits have been associated with Makop intrusions. Recovery inhibition behavior includes deletion of shadow copies and modification of boot settings prior to file encryption. Some variants also add persistence mechanisms before rebooting systems.

Makop has been linked to double-extortion style pressure in some family variants, with ransom notes claiming data theft prior to encryption. Related variants such as Ndm448 encrypt local and accessible network drives, traverse user and system directories extensively, and drop ransom notes while threatening disclosure of stolen data. Across reporting, Makop appears opportunistic rather than narrowly sector-specific, with operators reusing a stable mix of commodity tools and custom malware over several years.