LAMASHTU

LAMASHTU is a ransomware variant, identified primarily through its use in targeted attacks against various organizations, predominantly in the healthcare, education, and manufacturing sectors. It has been linked to a series of incidents that involve extortion, encryption, and data theft. The group behind LAMASHTU uses sophisticated techniques and tools, often leveraging publicly known vulnerabilities, with a focus on exploiting weak remote access systems and unpatched services.

The ransomware is delivered through phishing campaigns and remote access exploits, which then deploy the encryption payload, typically locking down files with a distinctive extension. In addition to encryption, LAMASHTU also exfiltrates sensitive data, threatening public exposure if ransom demands are not met.