Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomware

**Repellent Scorpius (Cicada3301)** — Unit 42 identifies a newly emerged RaaS group conducting double-extortion ransomware attacks since May 2024; the report provides a technical analysis of a Rust-based ChaCha20+RSA encryptor, demonstrates TTPs used (RDP credential access, embedded PsExec for lateral movement, rclone for data exfiltration), lists IoCs (hashes, IPs, onion leak site), describes a new encryptor variant and affiliate program activity, and offers mitigation guidance and contact paths for incident response.