The ransomware clones of HellCat & Morpheus.

SentinelLabs research reports that two Ransomware-as-a-Service operations, HellCat and Morpheus, have affiliates deploying nearly identical ransomware payloads, including similar encryption methods and ransom notes. The analysis notes the emergence of new groups (e.g., FunkSec, Nitrogen, Termite) and the return of established actors (Cl0p, LockBit 4.0) over the past six months, and suggests code/tool sharing or overlapping affiliates as a possible explanation though no definitive link to the Underground Team was established.