Makop Ransomware

Key Takeaways

• Background and History: First seen around 2020, Makop is a Ransomware-as-a-Service model derived from the Phobos ransomware family, with typical ransom demands averaging around $15,000.
• Hands-On Attackers: Modern campaigns are human-operated rather than automated; hackers manually scout targets, steal logins, escalate privileges, and shut down antivirus software before launching the payload.
• Multi-Stage Loaders: Operators use third-party delivery tools like GuLoader to drop secondary malware, making initial detection at the perimeter much harder.
• Defense Evasion via BYOVD: To disable EDR agents, attackers use "Bring Your Own Vulnerable Driver" tactics, loading legitimately signed but flawed drivers to gain kernel access and forcefully terminate security software.
• Proactive Defense for Early Detection: Enterprise defense cannot rely on post-infection recovery. Mitigating ransomware threats requires a layered security framework that involves interactive sandboxing to safely analyze incoming files and URLs to reveal concealed attack chains and integrating actionable Threat Intelligence to proactively enrich security controls, neutralize attacker persistence, and block ransomware activity prior to impact.

• Opportunistic & Regional Targeting: Attackers target any organization with exposed infrastructure and weak security. India currently accounts for 55% of documented attacks, leading the group to add custom uninstallation scripts for regional security software to their toolkit.

What is Makop Ransomware?

Makop Ransomware is an adaptable encryption threat designed to extort businesses. Originating around 2020 as a variant of the Phobos ransomware family, Makop has updated its methods to match current cyber threats. Instead of acting as a standalone, automated file locker, Makop operates as Ransomware-as-a-Service (RaaS). In this model, core developers maintain the code while independent affiliates launch the attacks, resulting in an average ransom demand of about $15,000 per incident.

In terms of operation, Makop has shifted its primary methodology. While early versions relied on basic execution techniques, modern Makop campaigns use human-operated network intrusions. This manual approach means that once initial access is gained, human attackers actively move through the victim's environment. They harvest credentials, locate high-value systems, and disable internal defenses before encrypting any data.

To challenge enterprise security controls, Makop’s delivery methods have also evolved. Security data shows the integration of GuLoader (a downloader active since 2019) to drop secondary Makop payloads. This is an important shift: by using loaders to run defense evasion routines prior to deployment, Makop operators can bypass standard signature-based perimeter security. Combining a standardized RaaS business model with multi-stage attack tactics makes Makop a persistent threat to mid-market and enterprise organizations globally.

How Makop Ransomware Threatens Businesses and Organizations

For modern enterprises, the primary threat of a Makop ransomware intrusion does not stem from a single, highly advanced exploit. Instead, it relies on the group's ability to systematically disable defenses, harvest internal credentials, and move laterally to maximize operational downtime.

Once inside a network, Makop operators maintain a fallback portfolio of local privilege escalation (LPE) exploits targeting core Windows subsystems (such as BITS, Win32k, and Windows Installers). If one exploit fails or is blocked by an active patch, the attacker cycles to another LPE primitive in their toolkit until administrative control is achieved.

Rather than writing complex custom kernel exploits, threat actors leverage signed, legitimate third-party drivers that contain known memory-access vulnerabilities. By registering these drivers as system services, they gain kernel-level access, allowing them to bypass operating system security boundaries and forcibly terminate Endpoint Detection and Response (EDR) solutions.

In addition to using generic tools to disable built-in Microsoft Defender protections, Makop operators deploy customized software uninstallers. These uninstallers are specifically tailored to silently remove regional security products (such as Quick Heal AV) popular in their primary target countries, demonstrating that the threat group adapts its toolkit based on the security solutions they expect to encounter.

Attackers leverage memory extraction tools to harvest plaintext passwords and authentication tokens directly from Windows memory, while simultaneously using specialized database harvesters to extract credentials stored locally across web browsers, email clients, and system databases.

For discovery and lateral movement, operators combine these stolen credentials with widely used network and port scanners. Because these scanning tools are frequently utilized by legitimate IT administrators, their network mapping activities easily blend into standard daily operational traffic, preventing SOC teams from flagging the pre-encryption reconnaissance phase.

Victimology: Who Is Most Vulnerable?

Makop targets organizations opportunistically, focusing on companies where IT security weaknesses make an attack low-cost and easy to execute. A considerable share of its attacks falls on countries in the EU, LATAM, and other regions.

The biggest risk factor for a Makop intrusion is having Remote Desktop Protocol (RDP) services exposed to the public internet without proper protections. Many vulnerable organizations run external RDP on default ports without enforcing Multi-Factor Authentication (MFA) or strict account lockout rules This leaves them open to automated RDP password-guessing and dictionary attacks. Threat actors use standard brute-force tools to crack weak credentials and gain quick access to the internal network.

Ideal targets include organizations that rely only on static, signature-based antivirus, run unpatched legacy systems, or grant widespread local admin rights to users.

How Does Makop Ransomware Function?

Detonating a Makop Ransomware sample inside ANY.RUN’s Interactive Sandbox shows that the runtime behavior of the malware proceeds through five distinct operational phases.

View full sandbox analysis →

Phase 1: Infiltration and Human-Operated Staging

Unlike self-replicating worms, Makop relies on an operator-led intrusion chain.

• Initial Entry: Threat actors gain an initial foothold by targeting exposed Remote Desktop Protocol (RDP) services, using automated tools to execute brute-force attacks against weak administrative credentials.
• Active Reconnaissance: Once inside, human operators conduct manual reconnaissance across the local network.
• Staging: Attackers escalate privileges, dump administrative credentials, disable local security software, and map connected network directories before dropping the main ransomware encryptor.

Phase 2: Interactive Execution and Payload Tuning

Upon launching the binary, the threat actor uses a local, interactive GUI dashboard to modify execution logic on the fly:

• "Delete" Option: Triggers self-deletion of the ransomware binary immediately after encryption completes to reduce forensic footprints.
• "Quick" Option: Accelerates the attack by encrypting only the first 40KB of each target file, corrupting databases and system files while avoiding CPU utilization spikes.
• "Net" Option: Forces the malware to scan, map, and encrypt all connected network shares and mounted drives.
• Target Selection: Operators can launch global system encryption ("Start") or target specific sensitive folders ("Start Folder").

Phase 3: Destruction of System Recovery Paths

To prevent administrators from restoring systems without paying, Makop executes background process commands to eliminate backup redundancy:

• wbadmin delete catalog -quiet – Wipes the Windows backup catalog, disabling standard system-restore points.
• vssadmin delete shadows /all /quiet – Silently deletes all Volume Shadow Copies (VSS) to destroy local backups.
• wmic shadowcopy delete – Uses Windows Management Instrumentation (WMI) to ensure any remaining shadow volumes are deleted.

Phase 4: Encryption and Dynamic Extension Appending

After destroying recovery paths, the ransomware encrypts target files and renames them using a partner-specific template: File_Name.Extension.[8-Character_ID].[Email_Address].[Ransomware_Extension].

Because Makop uses a RaaS model, contact emails and file extensions vary by affiliate deployment:

• Deployment Variant A: Uses systemofadown@cyberfear[.]com and appends the .decrypt extension.
• Deployment Variant B: Uses ginesomna@outlook[.]com and appends the .gines extension.
• Deployment Variant C: Uses terrysinger1@outlook[.]com and appends the .47IO extension.

Phase 5: Desktop Hijacking and Telemetry Exfiltration

After completing the encryption loop, the ransomware executes post-compromise actions to notify the victim and exfiltrate data:

• Ransom Demands: Drops README text files containing negotiation terms and an offer for free decryption of two small files as proof. Format length varies by affiliate.
• Visual Notification: Drops a custom BMP image and sets it as the active desktop wallpaper to notify users of the compromise.
• Geographical Exfiltration: Sends background requests to dynamic, rotating IP logger URLs. This exfiltrates the infected system's external public IP address and location coordinates so the RaaS group can track victims globally.

How Businesses Can Use ANY.RUN’s Threat Intelligence Against Makop Ransomware

Because Makop operates as an evolving Ransomware-as-a-Service (RaaS) with rotating affiliate infrastructure, contact emails, and appended file extensions, traditional static blocklists are insufficient for long-term protection. Security teams must shift from tracking temporary indicators to identifying durable technical fingerprints and behavioral patterns of the operation. By leveraging ANY.RUN’s Threat Intelligence, organizations can stay ahead of these evolving campaigns.

Threat Intelligence Lookup allows analysts to pivot from a single suspicious artifact to an entire cluster of related malicious activity:

threatName:"makop"

Threat Intelligence Lookup provides actionable Makop indicators and TTPs, delivering complete context on the threat. This includes rich intelligence on Makop attacks, such as C2 network indicators, BYOVD vulnerable drivers, dynamic file extensions, as well as full sandbox sessions demonstrating the entire execution cycle from staging to encryption.

For organizations requiring automated, high-speed protection, ANY.RUN’s Threat Intelligence Feeds provide a real-time stream of validated indicators. These feeds deliver a continuous flow of the latest C2 domains, malicious IPs, and payload hashes directly into SIEM, SOAR, and EDR platforms. By integrating these feeds, SOC teams can automatically block emerging malicious infrastructure and detect active intrusions before the final encryption phase occurs.

Conclusion

The ongoing global exploitation of Makop Ransomware proves a critical truth in enterprise cybersecurity: threat actors do not require complex, custom zero-day exploits to inflict devastating operational damage. By leveraging a low-complexity, human-operated intrusion strategy, combining unsecured RDP perimeters with public privilege escalation exploits and legitimate, vulnerable drivers, Makop operators reliably bypass security stacks and execute high-impact corporate extortion.

To counter this threat, organizations must move beyond static signature checks. Defending against RaaS affiliates requires a multi-layered security posture that prioritizes proactive external hardening (such as enforcing multi-factor authentication and strict account lockout rules) alongside aggressive patch management for local privilege escalation (LPE) vulnerabilities.

Frequently Asked Questions: Makop Ransomware

1. What is Makop Ransomware?

Makop is a corporate extortion ransomware strain that first appeared around 2020 as an offshoot of the Phobos ransomware family. It is operated under a Ransomware-as-a-Service (RaaS) model, where developers sell the encryptor framework to independent affiliates who execute targeted, human-operated network intrusions. The average extortion demand for a successful Makop compromise is approximately $15,000 USD.

2. How do Makop operators bypass enterprise endpoint protection and AV products?

Makop affiliates use a multi-tiered defense-evasion pipeline. To neutralize basic protections, they deploy lightweight tools like Defender Control and Disable Defender to disable Windows Defender. For more advanced endpoint agents, they leverage "Bring Your Own Vulnerable Driver" (BYOVD) tactics, loading signed, legitimate third-party drivers (such as ThrottleStop.sys or hlpdrv.sys) that contain memory-access vulnerabilities to execute kernel-level commands and forcibly terminate EDR agents. Additionally, they abuse legitimate administrative tools (like Process Hacker and IOBitUnlocker) and deploy customized uninstall software to target and remove regional antivirus products.

3. Why do Makop operators rely so heavily on Windows Local Privilege Escalation (LPE) exploits?

Because modern Makop attacks are manual, human-guided intrusions, securing administrative rights is a critical step in the lateral movement phase. Makop operators maintain a diverse fallback portfolio of Windows LPE exploits targeting core OS components (such as BITS, Win32k, and Windows Installers). By using exploits with reliable, publicly available Proof-of-Concepts (PoCs), the operators ensure they can consistently escalate local permissions to the SYSTEM level, which is required to load their vulnerable drivers, terminate security agents, and destroy system backup catalogs.

4. How does Makop attempt to block organizations from performing data recovery without paying?

Upon execution, Makop immediately launches a series of background process-tree commands to eliminate all localized recovery redundancy. It utilizes native Windows administrative system utilities to wipe the Windows backup catalog (wbadmin delete catalog -quiet), silently delete all Volume Shadow Copies (vssadmin delete shadows /all /quiet), and ensure any remaining shadow volumes are completely eradicated via Windows Management Instrumentation (wmic shadowcopy delete).

5. What are the critical indicators of a Makop intrusion that SOC analysts should monitor?

Security teams should monitor their networks for:

• High-volume, automated brute-forcing activity targeting exposed external RDP endpoints.
• The execution of unauthorized network scanning and port-mapping utilities (such as Masscan, NetScan, or Advanced IP Scanner).
• The registration of known vulnerable kernel drivers as system services (hlpdrv.sys or ThrottleStop.sys).
• The execution of administrative backup deletion commands (wbadmin, vssadmin, wmic shadowcopy).
• Background network requests contacting dynamic, rotating iplogger URLs.
• Files being renamed with partner-specific extensions and unique IDs following the template: File_Name.Extension.[8-Character_ID].[Email_Address].[Ransomware_Extension].