{"id":32610,"date":"2020-01-04T00:36:36","date_gmt":"2020-01-04T00:36:36","guid":{"rendered":"http:\/\/92baafb1-3bc8-4330-81c0-a4e17db0b43f"},"modified":"2020-01-04T00:36:36","modified_gmt":"2020-01-04T00:36:36","slug":"deathransom-evolves-from-joke-to-actual-ransomware","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/","title":{"rendered":"DeathRansom evolves from joke to actual ransomware"},"content":{"rendered":"<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet1.cbsistatic.com\/hub\/i\/2020\/01\/03\/13fa9a5f-7d54-4635-b517-317b2204e9ee\/deathransom-encryption.png\" class alt=\"DeathRansom encryption\"><\/span><\/p>\n<p><span class=\"caption\">The latest encryption scheme used by the DeathRansom ransomware<\/span><\/p>\n<p><span class=\"credit\">Image: Fortinet<\/span><\/p>\n<p>A ransomware strain known as DeathRansom, once considered a joke, is now capable of encrypting files using a solid encryption scheme, cyber-security firm Fortinet reported today.<\/p>\n<p>Making matters worse, the ransomware has been backed by a solid distribution campaign, and has been making regular victims on a daily basis for the past two months.<\/p>\n<h3>First DeathRansom versions didn&#8217;t encrypt anything<\/h3>\n<p>First DeathRansom infections were reported in November 2019. Initial versions of this ransomware were deemed a joke. At the time, DeathRansom merely mimicked being a ransomware without encrypting any of a user&#8217;s files.<\/p>\n<p>These first versions would add a file extension to all of a user&#8217;s files and drop a ransom note on the user&#8217;s computer asking for money.<\/p>\n<p>All of this was done in an attempt to trick a victim into paying a ransom demand, without the user realizing that their files weren&#8217;t actually encrypted.<\/p>\n<p>As was reported at the time [<a href=\"https:\/\/id-ransomware.blogspot.com\/2019\/11\/wacatac-ransomware.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">1<\/a>, <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/new-deathransom-ransomware-begins-to-make-a-name-for-itself\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">2<\/a>], all a user had to do to regain acess to their encrypted files was to remove the second extension from any file.<\/p>\n<h3>New version released with a solid encryption scheme<\/h3>\n<p>However, work on the DeathRansom code continued, and newer versions are now working as actual ransomware.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>According to Fortinet, the new DeathRansom strains use a complex combination of &#8220;Curve25519 algorithm for the Elliptic Curve Diffie-Hellman (ECDH) key exchange scheme, Salsa20, RSA-2048, AES-256 ECB, and a simple block XOR algorithm to encrypt files.&#8221; [see image above]<\/p>\n<p>While security researchers are still looking at DeathRansom&#8217;s encryption scheme for implementation faults, the ransomware appears to be using a solid encryption scheme.<\/p>\n<h3>Fortinet tracks down the DeathRansom author<\/h3>\n<p>But Fortinet&#8217;s investigation into DeathRansom didn&#8217;t limit itself to analyzing this new malware&#8217;s source code. Researchers also went looking for clues about the ransomware&#8217;s author.<\/p>\n<p>By extracting strings from the DeathRansom source code and websites distributing the ransomware payloads, the Fortinet crew was able to successfully link the DeathRansom ransomware to a malware operator responsible for a wide range of cybercrime campaigns going back years.<\/p>\n<p>Fortinet said that prior to creating and distributing DeathRansom, this malware operator had spent his time infecting users with multiple password stealers (Vidar, Azorult, Evrial, 1ms0rryStealer) and cryptocurrency miners (SupremeMiner).<\/p>\n<p>The DeathRansom author appears to have spent years infecting users with malware, extracting usernames and passwords from their browsers, and selling the stolen credentials online, according to various ads Fortinet found on underground hacking forums.<\/p>\n<p>These past malware campaigns left a considerable trail of clues that Fortinet analysts collected. These included the scat01 and SoftEgorka nicknames, the vitasa01[@]yandex.ru email address, a Russian phone number, and the gameshack[.]ru website (which appears to have been owned and operated by the DeathRansom author rather than being a hacked site).<\/p>\n<p>Using these indicators, researchers found profiles on Iandex.Market, YouTube, Skype, VK, Instragram, and Facebook. All of these linked back to a young Russian named Egor Nedugov, living in Aksay, a small Russian town near Rostov-on-Don.<\/p>\n<p>Past posts on hacking forums reveal that Nedugov, acting under the Scat01 username, had posted reviews for malware strains he was using at the time, and which Fortinet later tracked down and documented in their report &#8212; such as Vidar, Evrial, and SupremeMiner.<\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/article\/deathransom-evolves-from-joke-to-actual-ransomware\/\" class=\"lazy\" alt=\"deathransom-forum-posts.png\" data-original=\" https:\/\/zdnet4.cbsistatic.com\/hub\/i\/2020\/01\/04\/2ec3fedd-86a7-498d-aecb-f0b390be297e\/deathransom-forum-posts.png\"><\/span><noscript><\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet4.cbsistatic.com\/hub\/i\/2020\/01\/04\/2ec3fedd-86a7-498d-aecb-f0b390be297e\/deathransom-forum-posts.png\" class alt=\"deathransom-forum-posts.png\"><\/span><\/p>\n<p><\/noscript> <span class=\"credit\">Image: Fortinet<\/span><\/p>\n<p>In an expansive <a href=\"https:\/\/www.fortinet.com\/blog\/threat-research\/death-ransom-new-strain-ransomware.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">two<\/a>&#8211;<a href=\"https:\/\/www.fortinet.com\/blog\/threat-research\/death-ransom-attribution.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">series<\/a> report published today, Fortinet lists all of Nedugov&#8217;s online accounts and the obvious mesh of connections between them.<\/p>\n<p>Fortinet said it&#8217;s very confident they found the right man behind DeathRansom, and that they found even more online profiles from the same actor which they didn&#8217;t include in their report.<\/p>\n<p>Furthermore, the DeathRansom author also appears to have broken one of the unwritten rules of the underground cybercrime scene by &#8220;phishing and scamming of his forum mates.&#8221;<\/p>\n<p>&#8220;That is why nearly all his accounts on underground forums were eventually banned,&#8221; Fortinet said.<\/p>\n<p>Currently, DeathRansom is being distributed via phishing email campaigns. The Fortinet report contains indicators of compromise that companies can include in their security products and prevent corporate systems from getting infected. Fortinet also said it&#8217;s still working on analyzing the ransomware&#8217;s encryption scheme foor any possible faults, which they hope to use to create a free decrypter to help past victims.<\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/deathransom-evolves-from-joke-to-actual-ransomware\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A highly active ransomware strain once considered a joke is now capable of encrypting files using a solid encryption scheme.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":32611,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-32610","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>DeathRansom evolves from joke to actual ransomware 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DeathRansom evolves from joke to actual ransomware 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-04T00:36:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/deathransom-evolves-from-joke-to-actual-ransomware.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"555\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"DeathRansom evolves from joke to actual ransomware\",\"datePublished\":\"2020-01-04T00:36:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/\"},\"wordCount\":723,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/deathransom-evolves-from-joke-to-actual-ransomware.png\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/\",\"name\":\"DeathRansom evolves from joke to actual ransomware 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/deathransom-evolves-from-joke-to-actual-ransomware.png\",\"datePublished\":\"2020-01-04T00:36:36+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/deathransom-evolves-from-joke-to-actual-ransomware.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/deathransom-evolves-from-joke-to-actual-ransomware.png\",\"width\":1000,\"height\":555},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/deathransom-evolves-from-joke-to-actual-ransomware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DeathRansom evolves from joke to actual ransomware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DeathRansom evolves from joke to actual ransomware 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/","og_locale":"en_US","og_type":"article","og_title":"DeathRansom evolves from joke to actual ransomware 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-01-04T00:36:36+00:00","og_image":[{"width":1000,"height":555,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/deathransom-evolves-from-joke-to-actual-ransomware.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"DeathRansom evolves from joke to actual ransomware","datePublished":"2020-01-04T00:36:36+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/"},"wordCount":723,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/deathransom-evolves-from-joke-to-actual-ransomware.png","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/","url":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/","name":"DeathRansom evolves from joke to actual ransomware 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/deathransom-evolves-from-joke-to-actual-ransomware.png","datePublished":"2020-01-04T00:36:36+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/deathransom-evolves-from-joke-to-actual-ransomware.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/deathransom-evolves-from-joke-to-actual-ransomware.png","width":1000,"height":555},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/deathransom-evolves-from-joke-to-actual-ransomware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"DeathRansom evolves from joke to actual ransomware"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/32610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=32610"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/32610\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/32611"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=32610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=32610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=32610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}