Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group

**Executive summary:** Group-IB's analysis documents the emergence of the Cicada3301 ransomware-as-a-service (discovered June 2024), detailing a Rust-based, multi-platform locker (Windows, Linux, ESXi, NAS, PowerPC), an affiliate panel with builder/landing capabilities, ChaCha20+RSA encryption modes, aggressive disruption techniques (VM shutdown, shadow copy deletion, process/service termination), published victim data across ~30 companies, and multiple IOCs and mitigation recommendations.