underground
E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.
About the group
Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.
Exploited vulnerabilities 1
CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.
CVE-2023-36884HIGHEPSS 99%KEV leak site
underground uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.
Explore the AI Autonomous Pentest →