Summary

The Howler Cell Threat Research Team conducted a detailed technical analysis of 0APT, a Rust-based ransomware family that recently surfaced alongside a coordinated bluff campaign. The operators publicly claimed to have compromised over 200 organizations within a short time span and advertised alleged victim access through their RaaS infrastructure.

However, no verifiable evidence of confirmed intrusions or operational encryption events has been observed. At the time of initial review, the group’s onion-based data leak site was accessible and displayed an extensive victim list. During later stages of the investigation, the onion site went offline.

Credibility on Leak Downloads

• The exposed RaaS panel raises additional concerns regarding credibility. The leak section presented on the panel advertises downloadable file trees, each reportedly oversized GB's.

• When initiating a download from the panel, the transfer attempts to pull a large archive immediately.

• The download does not complete in a practical timeframe. This behavior suggests the content may not represent genuine exfiltrated datasets.

• It appears structured to create the impression of large-scale data theft rather than to provide verifiable proof.

There are also no screenshots of compromised data hosted within the panel itself. The absence of preview evidence further weakens the credibility of the announced victims.

Credibility on Victim Claims

The scale and timing of the announcements also warrant scrutiny. 

• Claiming around 200 victims in a compressed time window, without supporting artifacts, is operationally inconsistent with observed ransomware group behavior.

• Mature groups typically stagger disclosures and provide proof of compromise to strengthen negotiation leverage. In this case, the announcements appear rapid and unsupported.

0APT Building Actual Threat Capabilities and Attracting an Affiliate Force

While the group’s initial campaign appeared to be largely inflated, with public claims of more than 200 compromised victims unsupported by verifiable evidence, this should not be interpreted as a lack of real capability. Our investigation confirms that the operators behind 0apt are running an active RaaS platform with functional malicious payloads and a working affiliate model.

The early bluff may have been intended to quickly build a reputation and attract a larger pool of partners, but it likely had the opposite effect, damaging credibility rather than strengthening it. Regardless, the group is now clearly moving forward with efforts to establish a legitimate cybercriminal operation.

Howler Cell researchers successfully accessed and validated the group’s onion-hosted RaaS portal, generated ransomware samples directly from the platform, and conducted full reverse engineering of the payloads. Analysis shows the malware is operationally viable, with builds customized per affiliate using unique build keys and affiliate identifiers while maintaining a consistent core codebase. The platform is actively positioned to recruit collaborators, allowing prospective affiliates to engage with the operators, generate customized ransomware builds, and deploy them independently. Once infections occur, affiliates handle victim communications and negotiations, with profits from extortion shared between the operators and their partners.

Attacker Attribution

Embedded Hindi language strings within debug logs may suggest a possible Indian linguistic influence associated with at least one developer. This observation remains speculative and should not be treated as attribution.

APT Payload - Technical Analysis

Sha256: 3dc4593b14879cb0bb4dc19e85816f09ff6a5f4db8c2957331b557af1fa1a375

The team analyzed a 64‑bit binary compiled with Rust version 1.92.0, which included 32 crates as dependencies. Upon execution, it looks for a file named Config2.txt in its current working directory (see Figure 1 for a snippet). If the file is missing, it falls back to using default configuration values hardcoded within the binary.

Figure 1: Config2.txt read to memory

Configuration Initialization

The Config2.txt file is a plain text configuration file containing key–value pairs, each placed on a separate line. These parameters adjust the ransomware’s behavior, including specifying files or directories to exclude from encryption. The field types supported by the 0APT ransomware are listed below in Table 1.

Table 1: 0APT Ransomware Configuration