First Python Ransomware Attack Targeting Jupyter Notebook

Team Nautilus observed and analyzed a Python-based ransomware attack against misconfigured, internet-exposed Jupyter Notebook servers: the attacker uploaded tools, created and executed a Python encryptor (cpt.py) that encrypts files and self-deletes, leaving no ransom note; detections via Tracee captured file drop and execution events and indicators include a characteristic dropped file named 'f1gl6i6z'.