AtomSilo Ransomware Enters the League of Double Extortion

AtomSilo is a double-extortion ransomware group active since ~September 2021; this report provides a technical analysis of their intrusion vector (Confluence exploit and DLL side-loading), post-exploitation techniques (WMI execution, use of admin accounts), encryption mechanics (XOR + AES with AESKEYGENASSIST, chunked encryption, .atomsilo file extension), exclusions/ransom note behavior, and leak-site operations including a published ~900 GB dataset and at least one MD5 IOC.