UnclassifiedUnknown
DefrayX
DefrayX is a threat actor group, tracked by Brandefense. It targets the Manufacturing and Healthcare sectors.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2018
- Record updated
Who They Target.
Sectors · 2
Labelsbdef-qf:latest
Vulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →CVE-2025-29824Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.ExploitedhighCVE-2025-24983Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.ExploitedhighCVE-2025-29814Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.high
Arsenal · Malware And Tools.
- RansomEXXmalware
About DefrayX.
DefrayX is a threat actor group known for their RansomExx ransomware operations. They primarily target Linux operating systems, but also release versions for Windows. The group has been active since 2018 and has targeted various sectors, including healthcare and manufacturing. They have also developed other malware strains such as PyXie RAT, Vatet loader, and Defray ransomware.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.