Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Ransom Notes: README0apt.txt


::: 0APT LOCKER :::

!!! ALL YOUR FILES ARE ENCRYPTED !!!

Hello,

If you are reading this message, it means your company's network has been breached 
and all your data has been encrypted by "0apt" group.

WHAT HAPPENED?
We have exploited vulnerabilities in your network infrastructure. All your servers, 
databases, and backups have been locked with military-grade encryption algorithms 
(AES-256 & RSA-2048). You cannot recover your files without our private key.

DATA LEAK WARNING:
Before encryption, we downloaded your confidential data . If you refuse to pay or do not contact us, this 
data will be published on our Tor blog for your competitors and regulators to see.

HOW TO GET YOUR FILES BACK?
We are not interested in destroying your business, we only want payment.
You must purchase a unique decryption tool from us.

>>> LEGAL & REPUTATION NOTICE (IMPORTANT):
We have analyzed your files If you do not pay:
1. We will send copies of this incriminating data directly to your GOVERNMENT 
   agencies and regulators to trigger an investigation against you.
2. We will email your clients, business partners, and everyone in your CONTACT 
   LIST to inform them that you lost their data.

INSTRUCTIONS:
1. Download and install Tor Browser: https://www.torproject.org/
2. Open Tor Browser and navigate to our chat portal:
   http://oaptxiyisljt2kv3we2we34kuudmqda7f2geffoylzpeo7ourhtz4dad.onion/login.php
3. Enter your Personal ID to start the negotiation
(If the website is down or inaccessible, please try again after some time.)

Your Personal ID:
[snip]-0APT-KEY

DEADLINE:
You have 24 hours to contact us. After this, the price will double.
If we do not hear from you within 48 hours, your data will be leaked permanently.

ATTENTION:
- Do not rename encrypted files.
- Do not try to decrypt using third-party software (you may lose data forever).
- Do not call the police or FBI (we will leak data immediately).

-- 0apt Team --

Indicators of Compromise
Type IOC
onion url http://oaptxiyisljt2kv3we2we34kuudmqda7f2geffoylzpeo7ourhtz4dad.onion/login.php