Eclipse Ransomware

Eclipse is an emerging Ransomware-as-a-Service operation publicly associated with the recruiting identity EclipseSupport. Analyst collection records an Eclipse actor-controlled onion publication dated 2026-08-07; public reporting began to describe the service by 2026-08-12. Early advertising positioned Eclipse as a deliberately productized RaaS targeting hybrid enterprise estates rather than a single-platform locker.

The service advertises Windows payloads written in Rust and Linux/NAS/VMware ESXi/Nutanix payloads written in C++, configurable encryption modes, ChaCha20 with Kyber-based key exchange, and functions aimed at recovery infrastructure. Marketing specifically names Hyper-V, Veeam backups, Nutanix snapshots, network-share propagation, Group Policy, PsExec/WMI, Microsoft Defender impairment, shadow-copy deletion, event-log clearing and process/service termination. These are advertised capabilities, not automatically incident-validated behaviors. Early public reporting explicitly cautioned that the feature list was recruitment copy rather than post-incident forensics.

Eclipse also advertises a structured affiliate economy: a USD 300 entry fee, a 90/10 affiliate/operator split for the first ten payments followed by 80/20, a stated minimum case value of USD 70,000, per-case BTC/XMR wallet management, negotiators, 2FA-protected management functions and leak-site publishing. Public trackers subsequently recorded multiple Eclipse victim disclosures from mid-August through early September 2026, including organizations in Singapore and the United States. Those listings increase confidence that the brand progressed beyond recruitment, but individual compromise, encryption and data-theft claims remain case-specific and not uniformly victim-confirmed.

INFERENCE (confidence: medium-high): Eclipse is transitioning from launch-stage RaaS marketing toward an operational extortion ecosystem. The strongest evidence for that transition is the appearance of sustained leak-site disclosures after the initial recruitment period; the principal uncertainty is how much of the advertised technical breadth is actually deployed by affiliates in real incidents.