Analysis and Attribution of the Eternity Ransomware: Timeline and Emergence of the Eternity Group

CloudSEK reports a financially motivated cybercriminal group called "Eternity" that sells worms, stealers, DDoS tools and a ransomware builder. The report includes a technical analysis of an Eternity ransomware sample (C#/.NET) that enumerates local and network drives, encrypts a wide range of file types with AES, protects the symmetric key by encrypting it with RSA and storing it as a Base64 file on the victim desktop, deletes shadow copies via WMI, establishes persistence via Run key, and uses a UI with keyboard hooks; it also provides actor attribution links to a GitHub account L1ghtM4n and related projects (Jester, Vulturi) and includes communication/contact IoCs (Telegram, ProtonMail).