CollapseGroup Active

Ransomware group first observed in 2024. Uses nltest for deployment.
PDF Report Back to Groups
0
Total Victims
2024-02-01
First Seen
2026-02-27
Last Seen
7
Known TTPs
35.5d
Avg Delay
0
Negotiations
ONION URLS
svr5fopviu7pvipggfeskxex4nkt425uchjwy4wcywu3ntvk4quckthz.onion
TOOLS
nltest Rubeus
FILE EXTENSIONS
.dead
ACTIVITY TIMELINE
TOP SECTORS
TOP COUNTRIES
ACTIVITY HEATMAP
Date Victim Name Country Sector Status
No victims recorded
Technique ID Technique Name Tactic
T1552.001 Credentials In Files Credential Access
T1027 Obfuscated Files or Information Defense Evasion
T1562.004 Disable or Modify System Firewall Defense Evasion
T1059.005 Visual Basic Execution
T1490 Inhibit System Recovery Impact
T1133 External Remote Services Initial Access
T1080 Taint Shared Content Lateral Movement
CollapseGroup_rule_1 YARA-Rules/rules 
rule CollapseGroup_ransomware_1 {
    meta:
        description = "Detects CollapseGroup ransomware"
        author = "RansomwareMonitor"
        date = "2026-03-06"
        hash = "b384c3dd0753cfb0945ddbf535baec91a635ffeffd5391004c99041f859cd4a0"

    strings:
        $s0 = "TOX:" nocase
        $r1 = /[A-Za-z0-9]{56}\.onion/
        $s2 = ".onion" nocase
        $h3 = { AC 44 E1 6E 4E 16 84 A2 E4 5B 75 62 0B EC F1 5E 2C 06 A }
        $s4 = "Do not modify" nocase
        $h5 = { 47 87 B2 4F C8 B1 A9 62 7A 1F 5 }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        3 of them
}
CollapseGroup_rule_2 Florian Roth 
rule CollapseGroup_ransomware_2 {
    meta:
        description = "Detects CollapseGroup ransomware"
        author = "RansomwareMonitor"
        date = "2026-03-06"
        hash = "2571e6342bbe870cca11b602cf6217a9f6d638ad05012fc842334e6df58e6102"

    strings:
        $s0 = ".collapsegroup" nocase
        $r1 = /README\..{3,10}/i
        $s2 = ".collapsegroup" nocase

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        2 of them
}
CollapseGroup_rule_3 VirusTotal 
rule CollapseGroup_ransomware_3 {
    meta:
        description = "Detects CollapseGroup ransomware"
        author = "RansomwareMonitor"
        date = "2026-03-06"
        hash = "163316b0fd78474929ff93535075e52ac5bfd1d71a28731502aa0db3e0d96a29"

    strings:
        $r0 = /README\..{3,10}/i
        $s1 = ".collapsegroup" nocase
        $h2 = { 2C 96 37 91 88 0C F2 CD A0 41 8A 5A 4B 30 B4 }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        2 of them
}

No IoCs

No ransom notes