Threat Assessment: Matrix Ransomware
Summary: Matrix is a ransomware family first identified publicly in December 2016 that has primarily targeted small- to medium-sized organizations, observed as of 2019 across the U.S., Belgium, Taiwan, Singapore, Germany, Brazil, Chile, South Africa, Canada and the UK. Its primary attack vector shifted in 2018 from spam email, Windows shortcut propagation and the RIG exploit kit to brute forcing weak Remote Desktop Protocol credentials, and it encrypts user files and network shares, deletes volume shadow copies and disables recovery options.
What you should know: Matrix does not demand a fixed ransom: operators ask victims to send about three to five files for decryption so they can set a variable price based on the predicted value of the victim's files or the current dollar value of Bitcoin, which puts the size of the loss in the attacker's hands rather than a published figure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026