Derp.ca
Ransomware group

OnePercent

OnePercent Group is a cybercriminal operation active since at least November 2020 that targeted US organizations using phishing with IcedID trojans, Cobalt Strike, and double-extortion, threatening a "one percent leak" of data before escalating to a full dump or sale to REvil; the FBI issued a formal flash advisory in August 2021.

Profile source: Ransomware.live opens in a new tab

OnePercent

Family profile

OnePercent Group is a cybercriminal operation active since at least November 2020 that targeted US organizations using phishing with IcedID trojans, Cobalt Strike, and double-extortion, threatening a "one percent leak" of data before escalating to a full dump or sale to REvil; the FBI issued a formal flash advisory in August 2021.

Ransomware.live

Operational record

View group record ↗
1
YARA rules
1
Leak sites
0 available

Credential Theft

  • BetterSafetyKatz
  • Mimikatz
  • SharpKatz

Exfiltration

  • RClone

Offsec

  • Cobalt Strike
  • SharpSploit

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

adam:ONE opens in new tab Tria.ge opens in new tab IPinfo opens in new tab urlscan.io opens in new tab eCrime.ch opens in new tab Mallory opens in new tab