U-Bomb Ransomware Operation Profile
U-Bomb is a low-profile ransomware operation first observed in March 2023, also known as 0xFFF. The group operates semi-privately, targeting large enterprises and small-to-medium-sized businesses without apparent industry or target-type discrimination.
The operation shares visual similarities with Hive (Hunters International), though true links beyond surface-level or visual-only matches have not yet been corroborated. U-Bomb payloads exist for both Windows and Linux, with operations shifting focus to Linux as of November 2023.
How U-Bomb Attacks
U-Bomb payloads arrive primarily through phishing email, though campaigns have also been observed via exposed or vulnerable services and third-party offensive frameworks, including BRC4, Sliver, and Cobalt Strike.
On Linux, the encryptor takes a single --paths= command-line argument to specify which filesystem paths to encrypt. In a non-root context, the payload encrypts whatever objects are available and granted under the supplied paths. When running as root, the attacker can pass / as the path, effectively wiping the entire host.
Active Data Leak Site
The operation maintains an active data leak site at contiuevxdgdhn3zl2kubpajtfgqq4ssj2ipv6ujw7fwhggev3rk6hqd.onion, last visited on 28 April 2026 at 07:21:59 UTC, confirming continued operation.
The leak site includes a RECOVERY_INSTRUCTIONS.txt file, a YARA rule (u-bomb.yar), and a single IoC email address: ellen0xffff@proton.me. The site is sponsored by Hudson Rock, which tracks Infostealer-to-ransomware chains.
Detection and Mitigation
SentinelOne Singularity XDR identifies and stops U-Bomb ransomware activity across the full attack chain. The platform can return compromised systems to their original state using either the Quarantine or Repair action, depending on the deployment context.
Without SentinelOne deployed, detection requires a multi-layered approach. Organizations should run anti-malware software capable of detecting and blocking known ransomware payloads, pair it with email filtering to identify and report suspicious inbound messages, and maintain a tested backup and recovery plan to restore data post-encryption. The combination covers the primary delivery vector and the encryptor stage on both Windows and Linux hosts.
Key points
- U-Bomb ransomware has been active since March 2023 and is also known as 0xFFF.
- The data leak site runs at a .onion address last visited 2026-04-28T07:21:59.
- Known victim contact is ellen0xffff@proton.me.
- Payloads are delivered via phishing email and use BRC4, Sliver, and Cobalt Strike for lateral movement.
- Linux payloads are distributed as .sh files but are ELF binaries; they take a single --paths= argument and can encrypt the entire root filesystem.