Rook is a ransomware group that emerged in late November 2021, distinguishing itself by its operational model largely derived from the leaked Babuk ransomware source code. The group primarily pursues financial gain through a dual-extortion scheme, encrypting victim files and exfiltrating sensitive data to pressure payment. Its unique initial self-introduction on its leak site expressed a desperate need for money. The group gained attention quickly, with its first victim, a Kazakh financial institution, identified just days after its initial appearance. Rook's activity was notable for its rapid adoption of leaked code and its multi-threading engine for efficient encryption. There is evidence to suggest that the group may have rebranded as Pandora in early 2022 due to significant tactical similarities, but this is a suspected connection rather than a confirmed alias.

Paises afectados

URLs nuevas detectadas en IntelTracker