Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777

Summary: Unit 42 found that the Vatet loader, PyXie RAT and Defray777 ransomware are all tied to one financially motivated group operating since as early as 2018, hitting healthcare, education, government and technology sectors. The actors gain initial access through banking trojans such as IcedID or Trickbot, then deploy Vatet, PyXie and Cobalt Strike before running Defray777 entirely in memory, leaving only encrypted files and ransom notes.

What you should know: Defray777 is described as the first ransomware variant with standalone executables for both Windows and Linux, so a group that has stayed under the radar since 2018 now has a payload that crosses both operating systems in your estate.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026