Obscura, an obscure new ransomware variant

**Executive Summary:** Huntress Labs analyzes a newly observed ransomware variant named "Obscura" that was found on a domain controller and deployed via the NETLOGON/scripts share and scheduled tasks, encrypting files (full or partial) using X25519/XChaCha20 and appending a recoverable footer; the binary requires administrative privileges, terminates many security and backup processes, deletes volume shadow copies, and contains a base64-encoded ransom note claiming data theft and threatening leak unless paid. The report includes technical behavior, encryption and key-exchange details, exclusions list, observed IOCs (executable SHA256, ransom note filename, filesystem path, host name), and mitigation/monitoring guidance.