Wiki › Adversaries & Campaigns › Ransomware Groups › Makop

Makop

1 min read

Jump to:

Summary

Makop is a ransomware strain that targets Windows-based systems by encrypting files and demanding a ransom payment for their decryption. It is typically distributed through phishing emails, exploit kits, or malicious downloads, and is known for its rapid encryption process and use of strong cryptographic algorithms. Makop has been observed to specifically target enterprise environments, often seeking to maximize financial gain by demanding high ransom amounts.

Key Characteristics

Utilizes asymmetric encryption to lock victim files, making decryption without the private key difficult.
Commonly spreads via phishing campaigns, malicious email attachments, and exploit kits.
Targets a wide range of file types, including documents, images, databases, and backups.
Displays ransom notes demanding payment in cryptocurrency, typically Bitcoin, to avoid traceability.
May attempt to disable security software and delete shadow copies to prevent recovery.
Often includes a deadline for payment, threatening permanent data loss if ignored.

Defensive Controls

Implement robust email filtering and phishing detection to reduce the risk of initial infection.
Maintain up-to-date antivirus and anti-malware solutions with ransomware-specific detection capabilities.
Regularly back up critical data and ensure backups are stored offline or in immutable storage.
Apply timely security patches and updates to operating systems and applications to close vulnerabilities.
Restrict user permissions to limit the ability of ransomware to execute and spread.
Use endpoint detection and response (EDR) tools to monitor and respond to suspicious activities.

Makop

Summary

Key Characteristics

Defensive Controls

Related Security Solutions