Md5
4 total370fbcc6711fb983ae4679f02c5ac46129144c2f5acd859adf08d42ffcd74f50fb42dec2c39cd7884ca4cb6b76308f510f7d721e4e5e2ce0a5c629f2fd4ac572
Ransomware group
0APT
0APT is a Rust-based ransomware family associated with a ransomware-as-a-service (RaaS) operation that surfaced in January 2026.
Profile source: Mallory opens in a new tab0APT
Family profile
0APT is a Rust-based ransomware family associated with a ransomware-as-a-service (RaaS) operation that surfaced in January 2026. Reporting consistently describes the broader operation as using a coordinated bluff campaign: the operators claimed more than 150-200 victims, but multiple investigations found no verifiable evidence of confirmed intrusions, operational encryption events, or credible exfiltrated data for the listed organizations. Researchers assessed the leak site and exposed RaaS panel were likely designed to project credibility and attract affiliates, and some reporting concluded the scheme may have been intended to defraud aspiring affiliates. Despite those doubts around victim claims, researchers confirmed that 0APT operated a functional affiliate platform and were able to generate ransomware samples directly from the onion-hosted portal.
The RaaS platform supported customized build generation for Windows, Linux, and macOS, with up to five samples per affiliate account in one report. Builds were customized per affiliate using unique build keys and affiliate identifiers while preserving a common core codebase. The platform also included extortion workflow features such as negotiation chat, payment tracking, admin support, and technical documentation. Generated ransomware appends the .0apt extension to encrypted files and drops a ransom note named README0apt.txt; reverse engineering of one analyzed sample observed ransom notes written as README0apt.txt.0apt per directory.
A specifically analyzed sample had SHA-256 3dc4593b14879cb0bb4dc19e85816f09ff6a5f4db8c2957331b557af1fa1a375 and was a 64-bit Rust 1.92.0 executable. On execution, it looks for Config2.txt in the current working directory and falls back to hardcoded defaults if the file is absent. Configuration supports exclusions for extensions, filenames, and folders; default exclusions included many system and operational file types such as .exe, .dll, .sys, .msi, .bat, .com, .vbs, and .0apt, and folders such as /windows, /ProgramData, /Program Files, /Program Files (x86), /temp, /tmp, /cache, /google/chrome, and /mozila/firefox. The default configuration also skips files larger than 1 GB, uses the number of CPU cores for parallel encryption threads, requires at least 500 MB of free RAM, checks memory availability every 100 ms, and includes a one-minute sleep timer.
For cryptography, the sample attempts to read public_key.pem from the current directory and falls back to an embedded 2048-bit RSA public key if missing. Before encryption it checks for allpath.txt; if present, only listed files are encrypted, otherwise it scans broadly for targets. The sample uses hybrid encryption with RSA and AES-256: for each file it generates a 32-byte AES key and 16-byte IV using OsRng, encrypts the AES key with RSA-OAEP, encrypts file contents with AES-256 via a stream-compatible mode, overwrites the file with a structure containing the RSA-encrypted AES key, IV, and ciphertext, flushes with File::sync_all, and renames the file with the .0apt extension. It also contains a hardcoded wallpaper image that it writes as embedded_wallpaper.png into %TEMP% and sets as the desktop wallpaper.
Researchers reported no observed persistence, propagation, or advanced evasion features in the analyzed sample, and assessed it appeared intended for targeted, manually controlled intrusions rather than autonomous spread. Hindi-language strings were observed in debug or execution logs; reporting noted this may suggest Indian linguistic influence but does not support definitive attribution. High-confidence indicators and artifacts mentioned in the reporting include the .0apt file extension, ransom note names README0apt.txt and README0apt.txt.0apt, Config2.txt, public_key.pem, allpath.txt, embedded_wallpaper.png, and the analyzed sample hash 3dc4593b14879cb0bb4dc19e85816f09ff6a5f4db8c2957331b557af1fa1a375.
Ransomware.live
Operational record
Ransomware.live
Published indicators
Reported operators
Threat actors
1 named in public reporting"Intel 471 discovered the alleged 0APT malware sample... technical analysis of the malicious file indicated it was more of a work in progress than a fully operational ransomware malware sample."
Exploited software
Vulnerabilities linked to 0APT
4 CVEsMITRE ATT&CK
0APT in ATT&CK
45 distinct techniquesTechniques
45 techniques T1491 Defacement T1105 Ingress Tool Transfer T1486 Data Encrypted for Impact T1078 Valid Accounts T1133 External Remote Services T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1047 Windows Management Instrumentation T1059.001 Command and Scripting Interpreter: PowerShell T1204.002 User Execution: Malicious File T1053.005 Scheduled Task/Job: Scheduled Task T1547.001 Boot or Logon Autostart Execution: Registry Run Keys T1014 Rootkit T1027 Obfuscated Files or Information T1036 Masquerading T1055 Process Injection T1070 Indicator Removal T1140 Deobfuscate/Decode Files or Information T1562.001 Impair Defenses: Disable or Modify Tools T1564 Hidden Artifacts T1622 Debugger Evasion T1672 Email Spoofing T1678 Delay Execution T1003 OS Credential Dumping T1003.001 OS Credential Dumping: LSASS Memory T1555 Credentials from Password Stores T1082 System Information Discovery T1083 File and Directory Discovery T1135 Network Share Discovery T1526 Cloud Service Discovery T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1570 Lateral Tool Transfer T1005 Data from Local System T1039 Data from Network Shared Drive T1056 Input Capture T1119 Automated Collection T1560 Archive Collected Data T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service T1071.001 Application Layer Protocol: Web Protocols T1573 Encrypted Channel T1485 Data Destruction T1489 Service Stop T1490 Inhibit System Recovery
Reporting
Research mentioning 0APT
Feb 17
Cyber Security News
0APT Ransomware Group Claims 200 Victims but Fails to Deliver Any Real Data
A new ransomware operation called 0APT surfaced on the dark web in late January 2026... The platform allowed affiliates to generate five ransomware samples per account, supporting Windows, Linux, and macOS... Generated ransomware appends the .0apt extension and drops README0apt.txt.
Feb 16
Cyderes
0APT Bluff Campaign Evolves Into Potential Threat
The Howler Cell Threat Research Team conducted a detailed technical analysis of 0APT, a Rust-based ransomware family that recently surfaced alongside a coordinated bluff campaign.
Feb 6
Intel471
Likely fake ransomware operator 0APT causes panic - Our analysis | Intel 471
"Intel 471 discovered the alleged 0APT malware sample... technical analysis of the malicious file indicated it was more of a work in progress than a fully operational ransomware malware sample."
