H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DEATHRANSOM](https://attack.mitre.org/software/S0616) is ransomware written in C that has been used since at least 2020, and has potential overlap with [FIVEHANDS](https://attack.mitre.org/software/S0618) and [HELLOKITTY](https://attack.mitre.org/software/S0617).(Citation: FireEye FiveHands April 2021)

Labels

malware

9 recorded

Relationships

uses

to Data Encrypted for Impact

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inhibit System Recovery

Technique

uses

to Local Storage Discovery

Technique

uses

to Network Share Discovery

Technique

uses

to System Language Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Management Instrumentation

Technique

2 external

References

mitre-attack

S0616

FireEye FiveHands April 2021

https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html