Which threat actors have used RansomEXX Ransomware?

Who is behind RansomEXX activity?

RansomEXX is not usually tied to one single, fixed crew. Public reporting has associated it with financially motivated intrusion teams that combine ransomware deployment with theft and extortion, so the better question is which clusters, affiliates, or intrusion sets have been observed using it in a given case.

That matters because actor attribution can shift as tooling is reused, rebranded, or shared across operations. The same ransomware family may appear in incidents driven by different crews, with different initial access methods, privilege paths, and exfiltration workflows.

Defenders should treat attribution as an investigation output, not an assumption. Focus first on whether the environment shows the usual pre-encryption pattern, especially privileged access, remote administration, and signs that data was staged or moved before the payload executed.

How to interpret attribution without overcommitting

When a ransomware family is linked to multiple clusters, attribution should be read at two levels: the malware family itself and the intrusion team using it. That distinction helps avoid false precision, especially when reporting only names the family and not the operator behind that specific incident.

This is also why public reporting may name different groups for different attacks even when the encryption tooling looks the same. The operator may be a core crew, an affiliate, or a related intrusion set using a common ransom playbook.

For defenders, the practical value of attribution is to understand likely behaviour. A crew that favors theft before encryption often leaves a distinct trail: unusual privilege use, lateral movement through admin channels, archive creation, and outbound transfer activity before the impact phase.

What defenders should look for when RansomEXX is in play

The most useful signals are operational, not cosmetic. Look for unexpected use of remote management tools, newly created administrative sessions, rapid file rewrite activity, and evidence that large data volumes were accessed or staged shortly before encryption.

Because the family has been used in double-extortion style operations, data theft may be as important as encryption. That means the investigation should include log review for remote access, identity misuse, and any service accounts or privileged accounts that performed bulk activity outside their normal pattern.

It is also worth checking whether attackers tried to suppress visibility before detonation. A short gap between first elevated access and mass encryption can indicate a compressed intrusion cycle, which often leaves little room for manual detection if logging and alerting are weak.

Risk and Threat Considerations

RansomEXX activity is risky because the operator is often focused on both disruption and extortion. That combination increases the chance that data was exfiltrated before encryption, so the incident can become a confidentiality event as well as an availability event. See the broader family patterns discussed in Ransomware Groups Guide and the threat-actor framing in Threat Actor Groups Guide.

Failure mechanism: Attackers commonly obtain privileged access, move laterally through administrative channels, stage or steal data, and only then trigger encryption. If that sequence is missed, teams may see the ransomware event but miss the earlier compromise path and the exfiltration window.

Impact: The result can be broader than downtime. Organisations may face data exposure, extortion leverage, recovery delays, and uncertainty about whether the intrusion began days or weeks before the payload was deployed.

Practitioner Guidance

What to verify: Confirm which accounts, remote tools, and host sessions had high privilege in the hours or days before encryption. If you cannot show who had administrative reach, you do not yet have a complete incident picture.

Decision rule: If you see bulk file changes plus outbound transfer activity before encryption, treat the event as a likely double-extortion case and prioritise containment, credential review, and log preservation before rebuilding systems.

Practitioner takeaway: For RansomEXX, the family name matters less than the intrusion pattern, if you can reconstruct privilege use and pre-encryption exfiltration, you usually know far more about the real threat than attribution alone.

Related resources from NHI Mgmt Group

• What does AI model abuse reveal about the current NHI threat surface?
• What are effective practices for operationalizing NHI threat detection?
• Why do secrets stay dangerous even when they are no longer actively used?
• How should security teams harden macOS endpoints against trojanized admin tools used by threat actors?