Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Meow – Bulk Data Staging for Resale (No Encryption Payload)

Meow Exfiltration Sentinel
MITRE ATT&CK
Transfer Data to Cloud Account
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (meow) – no group-specific tool telemetry on file; generic pure-exfiltration detection logic
What This Detects
Meow transitioned from encryption-based RaaS to a data-extortion-only model – it doesn't deploy an encryptor, so hunting should focus on bulk data staging/copy activity consistent with preparing stolen data for resale.
Query
DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType in ("FileCopied","FileRenamed")
| summarize FilesTouched = count(), DistinctFolders = dcount(FolderPath) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where FilesTouched > 3000 and DistinctFolders > 15

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.