H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

RobbinHood

[RobbinHood](https://attack.mitre.org/software/S0400) is ransomware that was first observed being used in an attack against the Baltimore city government's computer network.(Citation: CarbonBlack RobbinHood May 2019)(Citation: BaltimoreSun RobbinHood May 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[RobbinHood](https://attack.mitre.org/software/S0400) is ransomware that was first observed being used in an attack against the Baltimore city government's computer network.(Citation: CarbonBlack RobbinHood May 2019)(Citation: BaltimoreSun RobbinHood May 2019)

Labels

malware
6 recorded

Relationships

uses
to Data Encrypted for Impact
Technique
uses
to Disable or Modify Tools
Technique
uses
to Inhibit System Recovery
Technique
uses
to Network Share Connection Removal
Technique
uses
to Service Stop
Technique
uses
to Windows Command Shell
Technique
3 external

References

mitre-attack
S0400
open
CarbonBlack RobbinHood May 2019
https://www.carbonblack.com/2019/05/17/cb-tau-threat-intelligence-notification-robbinhood-ransomware-stops-181-windows-services-before-encryption/
open
BaltimoreSun RobbinHood May 2019
https://www.baltimoresun.com/politics/bs-md-ci-it-outage-20190507-story.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance