0APT Ransomware - ASSESSED AS FAKE

0APT presented itself as a newly identified Ransomware-as-a-Service (RaaS) syndicate that emerged on January 28, 2026, claiming to have compromised 71 organisations across multiple sectors within 48 hours. The group claimed to employ double extortion tactics, combining AES-256/Salsa20 file encryption with data exfiltration and public leak threats. However, following in-depth research and analysis, Red Piranha has assessed that 0APT is a fraudulent operation - fake ransomware group that fabricates breach claims to pressure victims into paying ransoms for data compromises that never occurred. The claims, infrastructure, and victim listings are designed to manufacture an illusion of capability rather than reflect genuine technical intrusions.

THREAT ACTOR DESCRIPTION

Group Profile

0APT (pronounced "Zero-APT") presents itself as a financially motivated ransomware syndicate that explicitly distances itself from nation-state Advanced Persistent Threat actors. The group brands itself as a "politically neutral underground syndicate" focused purely on financial gain. Their ransom notes frame attacks as a "tax on security negligence" - psychological tactics designed to normalise payment and discourage victim resistance. Red Piranha’s assessment is that the group lacks genuine ransomware capabilities and instead relies on fabricated breach claims, recycled or publicly available data, and intimidation to coerce payments. All the victims listed on their leak site are assessed as manufactured or unverified claims, not confirmed compromises. Organisations listed by 0APT should conduct their own verification but should not assume a genuine breach has occurred based solely on 0APT’s claims.

Group Characteristics

RED PIRANHA ASSESSMENT: Red Piranha assesses that 0APT is a fake ransomware group operating purely through social engineering and fabricated breach claims. There is no confirmed evidence of actual ransomware deployment, data exfiltration, or genuine victim compromises. The phishing domains and credential harvesting operations represent the core of 0APT’s actual capabilities - these are social engineering tools, not indicators of a functional ransomware operation. The TTPs below are retained for defensive awareness purposes.

1. Data Leak Site (DLS) Analysis -Fabricated Data

Red Piranha’s internal analysis of the 0APT Data Leak Site (DLS), hosted at oaptxiyisljt2kv3we2we34kuudmqda7f2geffoylzpeo7ourhtz4dad.onion, confirms that the downloadable data offered as “proof” of victim compromises is entirely fabricated. Our findings are consistent with and corroborated by independent analyses from multiple threat intelligence firms.

1.1 Null Bytes and Random Noise

Red Piranha’s inspected the data files from the 0APT DLS revealed that the majority of file content consists of repeating patterns of null bytes. The files contain no meaningful data - no documents, no databases, no credentials, no personally identifiable information.

1.2 Missing File Signatures (No Valid Archive Headers)

Red Piranha’s analysis confirmed that downloaded files do not contain valid ZIP headers or any recognisable file format signatures. Standard archive formats (ZIP, RAR, 7z, TAR) begin with specific “magic bytes” -for example, ZIP files start with PK\x03\x04 (hex 50 4B 03 04). The 0APT files contain none of these signatures.

1.3 Artificially Inflated File Sizes

The 0APT DLS advertises file sizes reaching several terabytes per victim - a volume that would be extraordinary even for established ransomware groups. These sizes are artificially inflated by the streaming random data mechanism. Because the Tor network is inherently slow, an analyst attempting to download and verify a supposed data dump could spend days or weeks downloading what ultimately proves to be meaningless binary noise.

INDICATORS OF COMPROMISE (IOCs)

The following IOCs are associated with 0APT’s observed infrastructure and claimed operations. While the phishing domains and communication channels are confirmed as operational, Red Piranha assesses that 0APT is a fake ransomware group. These IOCs are provided for defensive blocking and awareness purposes. The phishing infrastructure remains a real threat for credential harvesting, even though the ransomware claims are fabricated.

Network Infrastructure

Tor Leak Site

Threat Actor Communication Channels

Crystal Eye 5.5 (Red Piranha)

1. Secure external access (RDP/VPN + apps): Enforce MFA on RDP/VPN, patch exposed apps, block legacy protocols, and apply WAF rules to catch auth bypass / API abuse / injection attempts.
   
   
2. Privilege management: Rotate admin/MSP credentials, disable unused accounts, enforce least privilege for service accounts (web apps + DB), and monitor privilege escalation inside CE SIEM.
   
   
3. Execution control + kill-chain correlation: Use CEASR to block unknown binaries executing from %TEMP% / %APPDATA%, restrict PsExec/WMI remoting, and correlate ransomware chains like bcdedit + vssadmin + PsExec, including alerts for AV/service stops.
   
   
4. Network controls + segmentation: Block known C2/IP/domain indicators, restrict outbound HTTPS to unknown IPs, limit SMB/WinRM east-west movement, isolate admin workstations, and segment AD / file servers / DB servers / critical infra from general user networks.
   ​​​​​​​
   
5. Backup hardening + IR playbook automation: Use offline/immutable backups, restrict backup server access, detect shadow-copy deletion attempts, validate restores periodically, and trigger rapid SOAR actions (isolate hosts, block hashes/onion/IOCs, rotate credentials, notify SOC).

Worldwide Ransomware Victims by Country

The United States remained the primary hotspot for ransomware activity, accounting for 42.65% of all identified victims. That means well over two out of every five known cases this period hit U.S. based organisations, keeping it far ahead of any other single country in terms of observable exposure.

A strong second tier consisted of the United Kingdom (8.06%) and Canada (5.69%), followed by Italy and India (each 3.32%), Brazil (2.84%), and Spain and Germany (each 2.37%). Together, this bloc of mature and large economies forms the bulk of non-U.S. activity, reflecting big digital footprints, consistent incident disclosure, and attractive victim profiles for extortion operators.

A broader mid-band followed, led by Malaysia (1.9%), and a cluster of countries at 1.42% each - Switzerland, Taiwan, Netherlands, Czech Republic, South Africa, Japan, New Zealand, Mexico, France. These figures show that ransomware is firmly entrenched across Europe, Asia-Pacific, and the Americas, not just in North America.

Below that, a long tail of lower-volume geographies - including Vietnam, China, Israel, Bulgaria, Thailand (each 0.95%), and a wide spread of Morocco, Tanzania, Peru, Slovenia, Colombia, Kenya, Philippines, Finland, Senegal, United Arab Emirates, Singapore, Bahamas, Mauritius, Australia, Argentina, Paraguay, Belgium, Chile, Slovakia, Indonesia, Greece (each 0.47%) appeared only sporadically. Individually they contribute small fractions, but collectively they reinforce the pattern: ransomware remains a global problem, touching dozens of countries rather than being confined to a handful of headline markets.