Technical Analysis of Industrial Spy Ransomware

Industrial Spy is a recently emerged ransomware/data-extortion group that began as a dark web marketplace in April 2022 and later added a proprietary ransomware in May 2022; the group both exfiltrates and sometimes encrypts victims' files. The report provides technical details on a non-destructive promoter trojan distributed via cracks/adware, the ransomware's operation (3DES per-file encryption with RSA-encrypted 3DES keys, shadow-copy deletion, exclusion lists, and a 0xFEEDBEEF footer), key-generation weaknesses, ransom note behavior, victim counts, and multiple SHA256 IOCs.