MetaEncryptor Continues Targeting Enterprises With Long-Dwell Ransomware Operations

Executive Summary

MetaEncryptor is a financially motivated ransomware group using a double-extortion model, combining data exfiltration with encryption. Since August 16, 2023, the group has published 52 victims across 13 countries, with activity concentrated in the United States, Germany, and Canada and significant targeting of Manufacturing, Professional Services, and Technology. Its operations are characterized by extended dwell times, privilege escalation, legitimate Windows tools for lateral movement, targeted data exfiltration, and consistent TTPs across incidents. The group maintains two known Tor-hosted leak sites, which are currently displaying maintenance notices.

Threat Profile

Group Overview

MetaEncryptor is a financially motivated ransomware group operating a double extortion model: encrypting victim environments while exfiltrating and threatening to publish sensitive data. The group is known for staying under the radar for extended dwell times; in one documented incident, close to a month passed between initial access and encryption. MetaEncryptor is notable for consistency in its tactics, techniques, and procedures across incidents, reusing the same initial access methods, tooling, and even internal folder-naming conventions across engagements observed years apart.

Operational Characteristics

MetaEncryptor maintains long dwell times between initial access and final impact, including cases approaching a month, while moving laterally from initially compromised standard user workstations to privileged Domain Admin-linked accounts and subsequently to servers. The group relies heavily on built-in, legitimate Windows tools and protocols for lateral movement to reduce detection rather than using custom malware, identifies and prioritizes servers of interest for data exfiltration before encryption, operates two known Tor-hosted data leak sites (DLS) to increase extortion pressure, and demonstrates strong TTP consistency over time by reusing the same access methods and operational patterns across incidents occurring years apart.

Victimology

Overview

Geographical Distribution

Victim data shows the United States as the most heavily targeted country, followed by Germany and Canada. Japan and South Korea recorded additional victims, while further victims were identified in Singapore, Luxembourg, Spain, the Netherlands, the United Kingdom, Italy, Austria, and Belgium. This distribution shows that MetaEncryptor’s identified victims are concentrated primarily in the United States, Germany, and Canada, with additional activity across Europe and Asia.

Sector Targeting

Technical Analysis

Initial Access: MetaEncryptor gains initial access through a compromised user workstation, using remote access trojan tooling to establish a foothold, and has in the past also leveraged spear-phishing with macro-enabled documents, credential stuffing, and exploitation of vulnerable internet-facing web services.

Execution, Discovery, and Lateral Movement: Following initial access, the group compromises a legacy account with Domain Admin privileges through identity-based attacks against Active Directory, including Kerberoasting. From there, MetaEncryptor moves laterally using built-in Windows tools and protocols, including PowerShell, PowerShell Remoting, WinRM, WMI, and Scheduled Tasks, establishing persistent footholds on compromised servers, from which the bulk of the attack is orchestrated.

Collection and Exfiltration: MetaEncryptor identifies servers holding data of interest and uses command-line WinRAR to stage and compress data prior to exfiltration. Data is exfiltrated to cloud storage using an open-source client. The group has also historically used tools to exfiltrate compressed and encrypted archives via SFTP-based scripting.

Encryption and Impact: MetaEncryptor performs local encryption of physical servers as well as virtualization hosts, and has historically used multi-threaded AES-256 encryption with RSA-2048 key wrapping, disabling Volume Shadow Copies and Windows Recovery features to inhibit restoration without payment.

Leak Site and Infrastructure Analysis

MetaEncryptor operates two known Tor-hosted data leak sites (DLS). As of the time of this report, both onion sites are displaying a maintenance notice, "Metaencrypter website is currently undergoing maintenance. Please come back later!", rather than active victim listings.

• This indicates the group is actively managing or temporarily taking down its own infrastructure, rather than the sites having been seized by law enforcement, and the sites may return to normal operation at any time.

• The group has previously also operated a custom-built negotiation portal on the Tor network as part of its extortion workflow, escalating pressure through staged disclosure of file samples and directory listings alongside the ransom note.

Available Leak-Site & Communication Indicators

MITRE ATT&CK TTPs

Indicators of Compromise (IOCs)

No independently confirmed IP-based infrastructure or file hashes are included here. This activity is being actively monitored, and this section will be updated as verified IOCs become available.

Mitigations & Recommendations

1. Initial Access Hardening

2. Identity & Credential Protection

3. Network Security & Lateral Movement Control

4. Endpoint Protection & Threat Monitoring

5. Data Protection & Exfiltration Prevention

6. External Exposure & Leak Monitoring

7. Backup & Recovery Strategy

8. Incident Response & Extortion Readiness

Conclusion

MetaEncryptor demonstrates sustained and consistent ransomware activity, characterized by extended dwell times, privilege escalation, legitimate Windows tooling, targeted data exfiltration, and data encryption. With 52 published victims across 13 countries and activity spanning multiple industries, the group has maintained a recurring operational pattern over several years. Its two known leak sites are currently displaying maintenance notices, but the group’s established infrastructure and continued victim activity indicate that its operations remain relevant for ongoing monitoring.