Elking

Elking is a type of malware, specifically a variant of the Phobos ransomware. Malware is a harmful program designed to exploit and damage computer systems, often infiltrating them via suspicious downloads, emails, or websites. Once inside a system, it can steal personal information, disrupt operations, or hold data hostage for ransom. Elking, along with other variants such as Eight, Devos, Backmydata, and Faust, is believed to be connected to Phobos ransomware due to similar tactics, techniques, and procedures (TTPs) observed in their intrusions. Phobos ransomware is an evolution of Dharma/Crysis ransomware. According to open-source reporting, it is likely linked to numerous variants, including Elking. This connection is suggested by the similar TTPs observed in related intrusions. The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have noted that Phobos ransomware operates in conjunction with various open-source tools such as Smokeloader, Cobalt Strike, and Bloodhound. In response to the threat posed by these ransomware variants, the US CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) issued a joint cybersecurity advisory. This advisory warned of attacks involving Phobos ransomware and its associated variants, including Elking. The advisory serves to inform and protect organizations from potential cyber threats associated with these malicious programs.