Elking

Elking is a type of malware, specifically a variant of the Phobos ransomware. Phobos itself is an evolution of the Dharma/Crysis ransomware and is connected to several other variants, including Elking, Eight, Devos, Backmydata, and Faust ransomware. This connection is established based on the similar Tactics, Techniques, and Procedures (TTPs) observed in intrusions by these various types of ransomware. Malware like Elking can infiltrate systems via dubious downloads, emails, or websites, often unbeknownst to the user, and can cause significant harm by stealing personal information, disrupting operations, or holding data hostage for ransom. In March 2024, US government agencies including the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) issued a joint cybersecurity advisory (CSA) to warn of attacks involving Phobos ransomware and its associated variants, such as Elking. According to the FBI and CISA, Phobos ransomware operates in conjunction with various open-source tools such as Smokeloader, Cobalt Strike, and Bloodhound, which further complicates the threat landscape. The advisory came after increasing instances of attacks linked to these ransomware variants were reported. The alert aimed at raising awareness among organizations and individuals about the potential threats posed by these malicious software variants and advising them on appropriate preventive measures. The shared TTPs among these ransomware variants underline the importance of comprehensive cybersecurity measures to protect against a range of interconnected threats.