Rancoz
Rancoz is a ransomware group with a financial motive, tracked by Brandefense. It targets 8 sectors, including Technology and Manufacturing, in 5 countries, including the United States and India. It uses 8 MITRE ATT&CK techniques.
- Techniques
- 8
- Exploited CVEs
- No CVE data
- First seen
- Nov 1, 2023
- Last seen
- Sep 16, 2025
- Record updated
Who They Target.
Sectors · 8
Countries · 5
Labelsransomware
About Rancoz.
Rancoz is a Windows-targeting ransomware strain first observed in November 2022 that appends the ".rec_rans" extension to encrypted files, considered a Vice Society copycat, deployed against a small number of organizations using double extortion and linked to the same developer as the "Buddy" ransomware.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.