Prometheus: New Ransomware Group Targets Organizations

The report details Cyble's analysis of the Prometheus ransomware group (affiliated with REvil) using a heavily obfuscated Thanos .NET ransomware variant: it enumerates processes, starts/stops and reconfigures services, kills backup/antimalware-related processes, modifies firewall/registry settings, performs AES encryption appending unique extensions, and drops ransom notes. The technical write-up includes runtime-obfuscated base64 strings, lists of targeted file extensions and processes, and a comprehensive list of SHA-256 IoCs, and it concludes with mitigation recommendations such as MFA, LAPS, least-privilege, endpoint defenses, and robust backup practices.