Doge Big Balls Ransomware Edward Coristine

This report analyzes a sophisticated, multi-stage ransomware campaign in which a finance-themed ZIP with a deceptive .lnk launches PowerShell-based loaders that retrieve a customized Fog ransomware ("DOGE BIG BALLS"), a kernel exploit tool (ktool.exe) that leverages a vulnerable signed driver (CVE-2015-2291) for SYSTEM token theft, and a lootsubmit.ps1 module that collects system/network data and queries Wigle.net for precise geolocation; the toolkit also contains a Havoc C2 beacon and numerous IOCs, with recommended mitigations including PowerShell logging, EDR deployment, restricting driver loads and outbound access to cloud/APIs.