Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
icefire.yar/*
IceFire ransomware (Linux/Windows)
*/
rule IceFire_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.icefire"
description = "Detects IceFire ransomware ransom note"
date = "2026-05-04"
severity = 7
score = 70
strings:
$s1 = "iFire-readme.txt" ascii nocase
$s2 = "IceFire" ascii nocase
$s3 = ".ifire" ascii
$s4 = "icefire.onion" ascii nocase
condition:
any of them
}