WidowStrike Active

Ransomware group first observed in 2016. Uses Meterpreter for deployment.
PDF Report Back to Groups
0
Total Victims
2016-11-01
First Seen
2026-01-26
Last Seen
0
Known TTPs
35.2d
Avg Delay
0
Negotiations
ONION URLS
esqctp5qdusz5hucrov7p35arnn4ez2rvewed7gptdcio2lx4hfgljlu.onion
TOOLS
Meterpreter SharpDPAPI ngrok FileZilla
FILE EXTENSIONS
.locked
ACTIVITY TIMELINE
TOP SECTORS
TOP COUNTRIES
ACTIVITY HEATMAP
Date Victim Name Country Sector Status
No victims recorded

No TTPs data

No YARA rules

TypeValueDescriptionCopy
md5 3ee100b67e003195e5217caf58265916 Malware sample hash observed in WidowStrike attacks
email payment210@tuta.io Infrastructure linked to WidowStrike
sha1 a7fe9480523fb138511a2ac5e20d7874351317a5 Infrastructure linked to WidowStrike

No ransom notes