Analysis
Apos employs a lightweight RaaS model with Golang encryptors featuring a dedicated .config PE section for runtime decryption and configurable settings (e.g., yAGRTb key). It supports double extortion, exfiltrating data before encryption for leak site threats. Affiliates access binaries, C2 infrastructure, and 80/20 profit splits via a panel. In Q1 2025, Apos documented 3 incidents per Dragos (up from near-zero in Q4 2024), contributing to 708 industrial ransomware cases—a 18% rise QoQ. Q2 saw 1 incident amid 657 cases (down 7% QoQ), highlighting selective targeting. Its rise aligns with 85+ active groups in Q3 2025 per Check Point, where top 10 held only 56% victims (down from 71% in Q1). DevMan's multi-RaaS ops (Apos/Qilin/DragonForce) amplified reach, claiming 54+ victims by July 2025 across manufacturing/IT.
Recent Attacks (2024-2025):
August 15, 2025 - ACMARK s.r.o. (Czech Republic): Breached consultancy; exfiltrated client contracts/PII, leaked after non-payment; estimated attack June 24, 2025.
Q2 2025 Industrial (US Manufacturing): 1 incident per Dragos; encrypted production systems in mid-sized plant, 2-week downtime; $200K BTC demand.
May 2025 DevMan Affiliate (APAC - China CI Construction): Encrypted 50GB alongside DragonForce; no payment, data leaked.
April 2025 Emergence (EU Professional Services): Initial DLS claim; financials leaked; overlapped with Qilin via DevMan.
Q1 2025 Probes (US): 3 low-profile hits, including Interlock overlap; focused on evasion testing.
September 20, 2025 - Prod Server Compromise: Encryptors exposed (no decryptors); victim data verified, negotiations shifted off-channel.
TTPs Used (MITRE ATT&CK Mapping):
Initial Access (TA0001): Spearphishing (T1566.001), valid accounts (T1078 via stolen creds), public app exploits (T1190 on VPNs).
Execution (TA0002): Command interpreter (T1059 e.g., PowerShell drops).
Persistence (TA0003): Scheduled tasks (T1053), remote software (T1219 e.g., AnyDesk).
Privilege Escalation (TA0004): Exploitation (T1068 on weak auth).
Defense Evasion (TA0005): Impair defenses (T1562 e.g., AV disable), log clearing (T1070.002), masquerading (T1036).
Credential Access (TA0006): Dumping (T1003 e.g., Mimikatz).
Discovery (TA0007): System/network recon (T1082/T1046 e.g., net view).
Lateral Movement (TA0008): Remote services (T1021 e.g., RDP/PsExec).
Collection (TA0009): Local data (T1005 e.g., RAR zips).
Command and Control (TA0011): Ingress transfer (T1105), RATs (T1219).
Exfiltration (TA0010): Over C2 (T1041).
Impact (TA0040): Encrypt for impact (T1486, AES-256 on <5MB files), inhibit recovery (T1490 e.g., VSS delete).
Detection: Monitor Golang binaries, .apos extensions, Tor traffic; EDR for PsExec/RDP anomalies and credential dumps.
Country Targeting:
Opportunistic global, emphasizing North America (US: ~50%, SMB manufacturing/professional services) and Europe (Czech Republic/EU: 30%, consultancies). APAC via DevMan (China: 10%). Avoids CIS; focuses mid-revenue ($100M-$500M) for rapid ops. Sectors: Professional services (40%), manufacturing (30%), IT (20%); mirrors Q1 2025 Veeam trends toward SMBs.
Relevant Important Info:
Affiliations: Core to DevMan (Qilin/APOS splinter); multi-RaaS boosts via RAMP ads; Russian origins. PEAR group reused Apos infra (e.g., AposPanel.styles.css) in September 2025.
Trends: Fits 2025 fragmentation (5.5 new groups/month); 22% attack drop Q1 QoQ but diverse TTPs. Ransoms $100K-$500K BTC; low payments due to leaks. No public decryptors; Q3 stable at 520-540 victims/month.
IOCs for App Integration: Hashes (e.g., SHA256: 4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b), Tor onion (aposdls[.]onion), IPs (185.208.156.* via DevMan). Prioritize TTPs; track Dragos/Cyble feeds.
RemediationIsolate impacted systems by disconnecting from networks and isolating non-essential devices to contain spread.
Evaluate scope: Scan for .apos files, exfiltrated data, and entry points (e.g., phishing logs) using EDR/forensics.
Remove malware: Wipe infected endpoints, rotate credentials, and eliminate persistence (e.g., tasks) with AV/EDR.
Recover from immutable offline backups: Verify integrity, restore critical systems first; do not pay ransoms.
Secure environment: Patch Windows/Linux, mandate MFA on VPN/RDP, and segment networks.
Review incident: Root cause analysis, IR plan updates, phishing training; report to CISA/FBI.