Apos Ransomware-as-a-Service (RaaS) Group

Apos is a Russian-speaking Ransomware-as-a-Service (RaaS) group that emerged in April 2024, advertising on forums like RAMP as a "new generation" tool with fast encryption and affiliate-friendly features. It uses Golang-based encryptors to append .apos extensions to files up to 5MB, employing AES-256 and dropping ransom notes with Tor links for negotiations. Affiliates earn 80% of profits via a dedicated panel. Tied to prolific operator DevMan (who also uses Qilin and DragonForce), Apos targets