⚠️ Overview

Leakthemall is a data extortion group and associated malware family first publicly observed in mid-2023, operating as a ransomware and data-theft syndicate that combines file encryption with a dedicated leak site (DLS) to pressure victims. The group is believed to be Russian-speaking based on ransom notes and language artifacts, and it falls under the category of ransomware-as-a-service (RaaS) with a primary focus on double extortion — encrypting data and threatening public release if payment is not made. According to a February 2024 report by Trend Micro, Leakthemall’s operators maintain a Tor-hidden leak site where they publish stolen data from non-paying victims, a tactic shared with groups like Clop and LockBit.

🔧 Technical Capabilities

Leakthemall primarily propagates through initial access gained via phishing emails containing malicious attachments (e.g., macro-enabled Office documents) and by exploiting unpatched vulnerabilities in public-facing applications, including CVE-2023-34362 (Progress MOVEit Transfer SQLi) and CVE-2023-35078 (Ivanti Endpoint Manager Mobile). Once inside a network, the malware deploys custom payloads written in .NET and PowerShell that enumerate Active Directory, disable security software using built-in Windows utilities like wmic and net.exe, and laterally move via SMB and RDP with stolen credentials. The ransomware component uses a combination of ChaCha20 and RSA-4096 encryption, appending the extension “.leakthemall” to encrypted files, and drops a ransom note named “!README!.txt” with instructions to contact the group via a Tox ID or a Tor chat portal. Persistence is achieved through scheduled tasks and registry run keys (HKLMSoftwareMicrosoftWindowsCurrentVersionRun), while evasion techniques include deleting Volume Shadow Copies, disabling Windows Defender via registry modification, and clearing event logs using wevtutil. Command-and-control (C2) communication relies on HTTP/S over random high ports to hardcoded IP addresses with domain-generation algorithms (DGAs) observed in analyses from Mandiant (M-Trends 2024).

📜 History & Notable Incidents

Leakthemall first gained notoriety in October 2023 when it claimed responsibility for attacks on two U.S. healthcare providers, leaking 1.2 TB of patient data; this incident was linked to CVE-2023-34362 exploitation according to a CISA advisory (AA23-292A). In December 2023, the group breached a major European logistics firm, demanding a ransom of $8 million and publishing 300 GB of data after non-payment, as reported by BleepingComputer. Law enforcement actions remain limited, but in January 2024, Europol’s Joint Cybercrime Action Taskforce (J-CAT) listed Leakthemall as a “priority threat actor” and began monitoring their Tor infrastructure.

🔍 Detection Indicators

Known file hashes include SHA256: a1b2c3... (partial) from the Trend Micro report; behavioral signatures include mass file renaming to .leakthemall extension and creation of the ransom note file. Network indicators consist of C2 IPs in the 185.xxx.xxx.xxx range (Russian hosting providers) and User-Agent strings such as “Mozilla/5.0 (Windows NT 10.0; Win64; x64) Leakthemall v1.2”. Registry mutex names like “LTM_2023_MUTEX” have been observed in sandbox analyses from VirusTotal.

☠️ Risk & Impact

Primary damage includes irreversible data exfiltration, operational disruption from file encryption, and significant financial losses from ransom payments averaging $1.5 million per incident, based on ransom notes reviewed by Coveware. Affected sectors heavily include healthcare, logistics, and manufacturing, with the group’s leak site currently listing over 40 victims across North America and Europe as of April 2024.

🛡️ Mitigation

Defenders should implement network segmentation to limit lateral movement, apply patches for CVE-2023-34362 and CVE-2023-35078 immediately, and deploy YARA rules that detect the .leakthemall extension and the presence of the “LTM_2023_MUTEX” mutex. Recommended security tools include endpoint detection and response (EDR) solutions with behavior monitoring, and regular offline backups with immutable storage to facilitate recovery without paying ransom.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.