Threat Assessment: Repellent Scorpius, Distributors of Cicada3301 Ransomware
Summary: Repellent Scorpius is a new ransomware-as-a-service group distributing Cicada3301 ransomware, with Unit 42 estimating operations began in May 2024 and leak site activity observed in June. The group runs a double extortion scheme, operates an affiliate control panel, and recruits initial access brokers and network intruders on Russian-language cybercrime forums, with its FAQ prohibiting attacks on CIS countries.
What you should know: Unit 42 found Repellent Scorpius holding a victim's data from an incident several years prior, with no recent signs of compromise in that environment - meaning data stolen long ago can resurface under a new ransomware brand. The group is actively recruiting affiliates, and Unit 42 expects a rising victim count on its leak site.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026