[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foY7qSJU5kjBYvLqk67hYBOZegGsPEcksSd4G5d--wt8":3,"$ftb76DcFpoPMj1ehxDgRFqjYwLjjQ3vM0pcMNP-hHU2E":52},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":49,"created_at":50,"updated_at":51,"published_at":33},"u-bomb-rware-runs-active-leak-site-with-proton-mail-and-brc4-sliver-cobalt-strik","U-Bomb Rware Runs Active Leak Site with Proton Mail and BRC4\u002FSliver\u002FCobalt Strike Lateral Movement","The low-profile 0xFFF group's .onion leak site was last visited April 28, 2026, and its known victim uses a Proton Mail address.","U-Bomb ransomware, active since March 2023, operates a data leak site at a .onion address last visited 2026-04-28, delivers payloads via phishing email, and uses BRC4, Sliver, and Cobalt Strike for lateral movement before encrypting Windows and Linux targets.",[10,11,12,13,14,15],"ransomware","U-Bomb","0xFFF","data-leak-site","phishing","BRC4","# U-Bomb Rware Runs Active Leak Site with Proton Mail and BRC4\u002FSliver\u002FCobalt Strike Lateral Movement\n\n*The low-profile 0xFFF group's .onion leak site was last visited April 28, 2026, and its known victim uses a Proton Mail address.*\n\n**Tags:** `ransomware` `U-Bomb` `0xFFF` `data-leak-site` `phishing` `BRC4`\n\n> U-Bomb ransomware, active since March 2023, operates a data leak site at a .onion address last visited 2026-04-28, delivers payloads via phishing email, and uses BRC4, Sliver, and Cobalt Strike for lateral movement before encrypting Windows and Linux targets.\n\n---\n\n## U-Bomb Ransomware Operation Profile\n\nU-Bomb is a low-profile ransomware operation first observed in March 2023, also known as 0xFFF. The group operates semi-privately, targeting large enterprises and small-to-medium-sized businesses without apparent industry or target-type discrimination.\n\nThe operation shares visual similarities with Hive (Hunters International), though true links beyond surface-level or visual-only matches have not yet been corroborated. U-Bomb payloads exist for both Windows and Linux, with operations shifting focus to Linux as of November 2023.\n\n## How U-Bomb Attacks\n\nU-Bomb payloads arrive primarily through phishing email, though campaigns have also been observed via exposed or vulnerable services and third-party offensive frameworks, including BRC4, Sliver, and Cobalt Strike.\n\nOn Linux, the encryptor takes a single `--paths=` command-line argument to specify which filesystem paths to encrypt. In a non-root context, the payload encrypts whatever objects are available and granted under the supplied paths. When running as root, the attacker can pass `\u002F` as the path, effectively wiping the entire host.\n\n## Active Data Leak Site\n\nThe operation maintains an active data leak site at `contiuevxdgdhn3zl2kubpajtfgqq4ssj2ipv6ujw7fwhggev3rk6hqd.onion`, last visited on 28 April 2026 at 07:21:59 UTC, confirming continued operation.\n\nThe leak site includes a `RECOVERY_INSTRUCTIONS.txt` file, a YARA rule (`u-bomb.yar`), and a single IoC email address: `ellen0xffff@proton.me`. The site is sponsored by Hudson Rock, which tracks Infostealer-to-ransomware chains.\n\n## Detection and Mitigation\n\nSentinelOne Singularity XDR identifies and stops U-Bomb ransomware activity across the full attack chain. The platform can return compromised systems to their original state using either the Quarantine or Repair action, depending on the deployment context.\n\nWithout SentinelOne deployed, detection requires a multi-layered approach. Organizations should run anti-malware software capable of detecting and blocking known ransomware payloads, pair it with email filtering to identify and report suspicious inbound messages, and maintain a tested backup and recovery plan to restore data post-encryption. The combination covers the primary delivery vector and the encryptor stage on both Windows and Linux hosts.\n\n## Key points\n\n- U-Bomb ransomware has been active since March 2023 and is also known as 0xFFF.\n- The data leak site runs at a .onion address last visited 2026-04-28T07:21:59.\n- Known victim contact is ellen0xffff@proton.me.\n- Payloads are delivered via phishing email and use BRC4, Sliver, and Cobalt Strike for lateral movement.\n- Linux payloads are distributed as .sh files but are ELF binaries; they take a single --paths= argument and can encrypt the entire root filesystem.\n\n## Further reading & sources\n\n- [Ransomware.live: u-bomb](https:\u002F\u002Fransomware.live\u002Fgroup\u002Fu-bomb)\n- [U-Bomb Ransomware: In-Depth Analysis, Detection, and Mitigation](https:\u002F\u002Fsentinelone.com\u002Fanthology\u002Fu-bomb)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fu-bomb-rware-runs-active-leak-site-with-proton-mail-and-brc4-sliver-cobalt-strik.png?v=fb0352777e",{"iocs":19,"actors":29,"malware":35,"technologies":43},[20,23,26],{"type":21,"value":22},"other","--paths=",{"type":24,"value":25},"email","ellen0xffff@proton.me",{"type":27,"value":28},"domain","contiuevxdgdhn3zl2kubpajtfgqq4ssj2ipv6ujw7fwhggev3rk6hqd.onion",[30],{"url":31,"name":32,"slug":32,"type":10,"origin":33,"motivation":34},"\u002Fthreat-groups\u002Fu-bomb","u-bomb",null,"financial",[36,38,39,41],{"name":37},"Sliver",{"name":15},{"name":40},"U-Bomb Ransomware",{"name":42},"Cobalt Strike",[44,47],{"vendor":45,"product":46},"Microsoft","Windows",{"vendor":48,"product":48},"Linux","ransomware_incident","2026-08-27T17:09:35.394473+00:00","2026-10-16T12:29:12.346969+00:00",{"articles":53},[54,66,78,89],{"slug":55,"title":56,"summary":57,"tags":58,"hero_image_url":64,"story_type":49,"created_at":65},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[10,59,60,61,62,63],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","2026-09-26T07:06:42.867972+00:00",{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":76,"story_type":49,"created_at":77},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[71,72,73,74,75,10],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":79,"title":80,"summary":81,"tags":82,"hero_image_url":87,"story_type":49,"created_at":88},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[83,84,10,85,86],"Dark Project","Brainhunter","double extortion","ransomware.live","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac","2026-09-21T07:02:16.98855+00:00",{"slug":90,"title":91,"summary":92,"tags":93,"hero_image_url":98,"story_type":49,"created_at":99},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[10,94,95,96,97],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00"]