3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
FunkSec

FunkSec

ID: 69cc5ffdc20c5e83a0f6b788a05a102963856
Crimeware Botnet Ransomware Trojan
Threat types: Phishing, Data Leak, Ransomware, Malware
Russia DZA, ARG, AUS, BGD, BRA, COL, EGY, FRA, DEU, ITA, JOR, MEX, MNG, PAK, PRY, ESP, USA, VNM, ZMB
Updated: 2026-04-04
Created: 2026-02-18
Progress: 89% Completeness: 89% Freshness: 90%
Operation zone: Algeria, Argentina, Australia, Bangladesh, Brazil, Colombia, Egypt, France, Germany, Italy, Jordan, Mexico, Mongolia, Pakistan, Paraguay, Spain, United States, Vietnam, Zambia
Aliases Limited alias preview
Funksec Group — — —
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

FunkSec is an emerging ransomware-as-a-service (RaaS) brand (late 2024) using double extortion and a Rust-based encryptor often called FunkLocker; public reporting emphasizes AI-assisted development and mixed operational maturity.


Technique Technique name Tactics Evidence
T1486 Data Encrypted for Impact TA0040
  • 2025-01-10 — Public reporting profiles FunkSec as a ransomware operation whose core impact is file encryption for extortion. · ref
  • 2025-07-01 — Kaspersky describes a Rust executable integrating full encryption capability as part of the operation. · ref
T1490 Inhibit System Recovery TA0040
  • 2025-12-16 — Picus reports deletion of Volume Shadow Copies using vssadmin to inhibit restoration (e.g., 'vssadmin delete shadows /all /quiet'). · ref
T1566 Phishing TA0001
  • 2026-02-18 — Defender-facing guidance lists phishing as a key distribution method consistent with FunkSec-style intrusions. · ref
  • 2025-01-10 — INFERENCE (confidence: medium): As a RaaS brand, FunkSec affiliates likely leverage common phishing-based initial access patterns observed across ransomware ecosystems. · ref
T1078 Valid Accounts TA0001 TA0003 TA0004 TA0005
  • 2026-02-18 — Defender-facing guidance lists credential abuse / 'stuffed credential attacks' as a distribution method for FunkSec ransomware. · ref
  • 2025-06-03 — INFERENCE (confidence: medium): Broad sector/geography victimology is consistent with opportunistic valid-account access and credential reuse at scale. · ref
T1041 Exfiltration Over C2 Channel TA0010
  • 2025-07-01 — Kaspersky describes a password mechanism that activates a more aggressive mode including data exfiltration behavior in addition to encryption. · ref
  • 2025-12-16 — INFERENCE (confidence: medium): Double extortion operations require staging and transferring data prior to encryption; exfiltration over network channels is therefore likely. · ref
T1562.001 Disable or Modify Tools TA0005
  • 2025-07-01 — Kaspersky notes the malware can disable many processes and includes self-cleaning behavior; this aligns with impairment of defenses (process/tool disruption). · ref
  • 2025-12-16 — Picus notes a hardcoded list of processes/services targeted for termination to avoid locked files during encryption; also functions as defense interference. · ref
Strategic Intelligence
Limited preview
Last updated: 2026-02-19T03:08:00+00:00

FUNKSEC — AI-assisted RaaS ransomware operation (FunkLocker)

Classification: TLP: WHITE - Open Source Intelligence (OSINT)

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for CISO — FUNKSEC


Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — FUNKSEC


Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-02-18T19:13:20+00:00

IOC Appendix (TLP:WHITE) — FUNKSEC


More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-02-19T03:31:41+00:00

OSINT Library — FUNKSEC


2025-12-16 — Picus Labs — “FunkSec RaaS Operations: Hacktivism Meets Cybercrime”

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/16
Address Verification SOCMINT
miniapps.ai/fun**** Restricted Not integrated
www.ransomlook.io/gro********** Restricted Not integrated
funksec.top Restricted Not integrated
keybase.io/fun********* Restricted Not integrated
Address Verification SOCMINT
7ixfdvqb4eaju5lzj4gg76kwlrxg4ugqpuog5oqkkmgfyn33h527oyyd.onion Restricted Not integrated
pke2vht5jdeninupk7i2thcfvxegsue6oraswpka35breuj7xxz2erid.onion Restricted Not integrated
ykqjcrptcai76ru5u7jhvspkeizfsvpgovton4jmreawj4zdwe4qnlid.onion Restricted Not integrated
funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion Restricted Not integrated
funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion Restricted Not integrated
funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion Restricted Not integrated
funk4ph7igelwpgadmus4n4moyhh22cib723hllneen7g2qkklml4sqd.onion Restricted Not integrated
funkyiazgfsrxrib6rnxbhkgfqi7isisfbqnwk2ycf7tpgfhtevlamad.onion Restricted Not integrated
funksec53xh7j5t6ysgwnaidj5vkh3aqajanplix533kwxdz3qrwugid.onion Restricted Not integrated
funksecsekgasgjqlzzkmcnutrrrafavpszijoilbd6z3dkbzvqu43id.onion Restricted Not integrated
funksec7vgdojepkipvhfpul3bvsxzyxn66ogp7q4pptvujxtpyjttad.onion Restricted Not integrated
funk45xqgrkrtej4743evcgv65oi3w4shwvjx3cvrdtqwul7gzkxuxqd.onion Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–2 of 2 images
Onion web sites Free Preview
Onion web sites
Onion web sites Free Preview
Onion web sites