morpheus Ransomware Group

Key insights

• •Morpheus utilizes a 64-bit portable executable ransomware payload, typically around 18KB in size.
• •Initial access methods are not publicly detailed, but the RaaS model suggests multiple approaches used by affiliates.
• •Ransom demands can reach up to 32 Bitcoin, equivalent to approximately $3 million USD.
• •The ransomware intentionally excludes specific file extensions from encryption to evade detection.
• •Victims are pressured through a data leak site where stolen data is listed.
• •Morpheus operates without modifying system settings or establishing persistence mechanisms.