logo

Inside the Onyx C2 Ransomware Business Model

ID: 1b02431a-47f6-5133-9e57-504e4c17ce74

STIX ID: report--1b02431a-47f6-5133-9e57-504e4c17ce74

Feed Name: Security Boulevard

Threat Score
70/100

Date Published: 2026-06-26

Date Updated: 2026-06-27

Author: Alan Shimel

...
...

The report describes Onyx C2, a ransomware-as-a-service observed in the wild (254+ occurrences) that offers turnkey malicious capabilities—keylogging, RATs, session cookie and MFA credential theft—for a low monthly cost; it warns this RaaS model is lowering the skill barrier and increasing attack volume and urges defenders to assume compromise and focus on stopping data exfiltration and building layered resilience.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.