Obscura is a Go-based ransomware strain first documented in July 2025, though analysts widely observed its activity starting in late August 2025. It distinguishes itself by directly weaponizing Windows Active Directory (AD) domain controllers for propagation, allowing it to rapidly spread across complex AD environments. Its primary motivation is financial, employing a double extortion model where it encrypts data and threatens to publicly leak stolen information if ransom demands are not met. The group utilizes XChaCha20 with Curve25519 for encryption and consistently drops ransom notes named 'README_Obscura.txt'. Security researchers anticipate that Obscura, currently in its early stages, may evolve into a Ransomware-as-a-Service (RaaS) offering due to its scalable deployment and Go binary structure.

Actores similares

Obscura 2.0threat-actor · 0

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker