H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[MegaCortex](https://attack.mitre.org/software/S0576) is ransomware that first appeared in May 2019. (Citation: IBM MegaCortex) [MegaCortex](https://attack.mitre.org/software/S0576) has mainly targeted industrial organizations. (Citation: FireEye Ransomware Disrupt Industrial Production)(Citation: FireEye Financial Actors Moving into OT)

Labels

malware

16 recorded

Relationships

uses

to Access Token Manipulation

Technique

uses

to Account Access Removal

Technique

uses

to Code Signing Certificates

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Disk Content Wipe

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to File and Directory Discovery

Technique

uses

to Inhibit System Recovery

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

Technique

uses

to Service Stop

Technique

uses

to System Checks

Technique

uses

to Windows Command Shell

Technique

4 external

References

mitre-attack

S0576

FireEye Financial Actors Moving into OT

https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html

IBM MegaCortex

https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/

FireEye Ransomware Disrupt Industrial Production

https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html