MAFIA ransomware targeting users in Korea

This report analyzes the MAFIA ransomware targeting Korean users, detailing its use of OpenSSL-based AES-256-CBC encryption that appends the .MAFIA extension, attempts to stop the South Korean AppCheck anti-ransomware service, and creation of an HTML ransom note. It communicates with C2 via Tor proxies (onion.pet/onion.plus), transmits IV and key values in HTTP GET parameters, and provides multiple sample hashes and domains as IOCs, indicating an active yet somewhat localized criminal ransomware threat.