Thanos Ransomware: Destructive Variant Targeting State-Run Organizations in the Middle East and North Africa
Summary: On July 6 and July 9, 2020, Unit 42 observed attacks on two state-run organizations in the Middle East and North Africa that installed a Thanos ransomware variant demanding "20,000$" in Bitcoin to a specified wallet. The variant was configured to overwrite the master boot record to display the ransom message, but the code threw an exception because the message contained invalid characters, leaving the MBR intact and the systems able to boot.
Key Takeaway: The actors already held valid credentials stolen from these networks before delivering the ransomware, and the same sample was used at both organizations, indicating a single actor with prior access rather than an opportunistic infection.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026