Discovery of a New Ransomware: “Obscura”

On August 29, 2025, Huntress Labs uncovered a new player in the cybersecurity world, shrouded in mystery and danger: the “Obscura” ransomware. The name itself surfaces prominently in its ransom demands, marked by a README_Obscura.txt file. This variant has shown its elusive presence by operating unnoticed in networks, especially where Huntress’s protective reach is limited. By the time it was detected, it had executed its malicious purposes from a particular path hidden deep within a domain controller’s file structures.

The Obscura’s cleverness lies in its disguise, adopting domain names to mask its villainy, making its presence challenging to discern early on. Encoded in Go, it hides in sophisticated file directories, indicating a calculated approach to infiltrate networks through the NETLOGON folder. These actions transform a seemingly innocuous “SystemUpdate” task into a Pandora’s box, spreading chaos through structured group policies. Further, a user-level task gave it a foothold to enable unwarranted Remote Desktop access, balancing stealth with effectiveness.

Activation of this ransomware signals a well-coordinated campaign: disabling recovery options and encrypting crucial data, all while dangling a sinister ransom note that intimates grave repercussions if unmet.

The Ransom Note’s Threat and Technical Depth

Demonstrating the art of intimidation, the ransom note claims comprehensive network domination, threatening data exposure if their financial demands aren’t met within a specific time. They even boast about using encryption techniques robust enough to seriously disrupt any half-hearted recovery attempts. It’s not just an encryption demand; it’s a masterclass in psychological warfare, warning against reliance on traditional recovery methods.

Technically, Obscura runs a check through the DAEMON environment variable. If witchcraft is set in motion (DAEMON=1), it adds encryption routines to its playbook. The ransomware adjusts its aggression level based on file sizes, employing EncryptFull or EncryptPart modes. The XChaCha20 encryption protocol, accompanied by ephemeral key usage, ensures files stay locked unless the ransom is paid.

This ransomware is a fresh face among nefarious entities like Crux and Cephalus. With cybercriminals adapting swiftly to evade law enforcement, organizations are urged to remain vigilant, especially around their domain controllers. Monitoring for unexpected file changes or access attempts could be a significant safeguard against evolving threats like Obscura.

For more insights into cybersecurity threats and to enhance your defense strategies, register for Tradecraft Tuesday, a must-attend resource for cybersecurity professionals.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.