Ransomware needs a way in. Stolen credentials are the cheapest one.
RunSomeWares Ransomware Group
Ransomware group profile
Description
RunSomeWares is a ransomware group that emerged in February 2025, utilizing a double extortion strategy to coerce victims into paying ransoms by encrypting data and leaking their sensitive information. Despite its public debut, the group has been linked to earlier incidents dating back to June 2024, primarily motivated by financial gain.
Key insights
- •Operates under a double extortion model, emphasizing both encryption and data leakage.
- •Initial access gained through spear-phishing and exploiting insider access.
- •Monetizes compromised access and stolen data similar to ransomware-as-a-service operations.
- •Utilizes a dedicated dark web portal to leak stolen data, increasing pressure on victims.
- •Limited information available on their specific malware or tooling.
Threat Level & Status Breakdown
For RunSomeWares · Based on incidents in selected period
No victim data for this group in the selected period.
Recent activity
Monthly attack count for RunSomeWares in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for RunSomeWares
- rnsmwareartse3m4hjsumjf222pnka6gad26cqxqmbjvevhbnym5p6ad.onion
- vnoa7t4c3wr6himmurl4it3ctvgmm6munjknuztqlu4nbz34367vokyd.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for RunSomeWares
T1486
T1486
T1490
T1490
T1078
T1078
T1021
T1021
T1080
T1080
T1562
T1562
T1021.001
T1021.001
T1040
T1040
T1071.001
T1071.001
T1059
T1059
Affected countries(3)
Countries where this group has been reported to target or leak victims.