Prometheus is a ransomware group that emerged in February 2021, operating a double extortion model where victim data is encrypted and threatened with public release if ransom demands are not met. The group functions like a professional enterprise, managing victim interactions through a unique customer service ticketing system that includes payment countdowns and refers to victims as "customers." While Prometheus claimed an affiliation with the prominent REvil ransomware group, cybersecurity researchers found no evidence to support this assertion, suggesting it was a tactic to bolster their reputation and increase pressure on victims. Prometheus is recognized for being a variant of the Thanos ransomware, utilizing the Thanos builder for its payloads. Its primary motivation is financial gain through these illicit ransomware operations, but its origin remains unconfirmed.
Tecnicas MITRE
T1199, T1071, T1190, T1123, T1105, T1490
RansomLook pivots
Data, inteligencia y referencias externas para contrastar actividad ransomware del actor.