Obscura, an Obscure New Ransomware Variant

On 29 August 2025 Huntress analysts identified a previously unseen Go-based ransomware called “Obscura” that was placed in the domain controller NETLOGON/Sysvol scripts folder and thereby automatically replicated across the environment; the actor created scheduled tasks to execute the binary, enabled RDP via firewall changes, deleted volume shadow copies, and used aggressive process termination (targeting ~120 security/backup/database services) before encrypting files with XChaCha20/X25519 per-file keys. The report includes detailed technical analysis of privilege checks, daemon behavior, encryption/footer format, exclusion rules, and IOCs such as README_Obscura.txt and a provided SHA256 for the executable.