RansomExx
RansomExx is a ransomware group with a financial motive, tracked by Brandefense. It targets 13 sectors, including Government and Technology, in 23 countries, including the United States and the United Kingdom. It uses 26 MITRE ATT&CK techniques and exploits 8 known CVEs.
Also known as
- Ransom X
- Defray777
- Defray 2018
- Gold Dupont
- Defray
- RansomExx2
- Sprite Spider
- Hive0091
- Techniques
- 26
- Exploited CVEs
- 8
- First seen
- Jun 1, 2020
- Last seen
- Mar 31, 2025
- Record updated
Who They Target.
Sectors · 13
Countries · 23
Labelsdormant-q2-2025double-extortionlinux-ransomwareraasransomexxransomexx2ransomwarerust-ransomwaretargeted-ransomware
About RansomExx.
RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.