Underground Marketplace Unveils New Ransomware Offering QBit with Advanced Encryption & Customization

**Executive summary:** On 23 Oct 2023 CloudSEK observed the QBit RaaS family — a Go-written, UPX-packed ransomware targeting Windows (x86/x64) and multiple Linux distributions with an ESXi variant in development; it offers hybrid Salsa20+RSA-2048 encryption modes (full/partial/smart), process/service termination, multi-threading, anti-analysis techniques, a configurable encrypter and a separate File Stealer that exfiltrates to mega.nz, and the actor advertises an 85/15 affiliate profit split; sample IoCs and SHA256 hashes were provided.