Satan Ransomware-as-a-Service (RaaS) is similar to previous RaaS platforms but employs far superior default obfuscation and evasion techniques. Most RaaS payloads are highly detectable and require the use of a “crypter,” while Satan provides XoR functions to encode and other means of delivering/proxying fully undetectable (FUD) payloads.With Petya, Mischa, and Shark RaaS platforms no longer in underground operation, Satan is the most popular and free RaaS platform; making it very attractive to black hat hackers. Several members are utilizing Satan RaaS and reporting pending victim payments...READ MORE
Wapack Labs has extensively reported on ransomware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.
TLP: AMBER
ACTOR TYPE: (III)
SERIAL: IA-009-2017
COUNTRIES: All
INDUSTRIES: All
REPORT DATE: 20170307
