TL;DR

• Monkey (Linux ransomware): x64 ELF ransomware written in Go, disables Linux protections, establishes persistence via cron, rc.local, and systemd, collects system information, changes wallpaper, and drops a ransom note. Detection via /etc/systemd/system/monkey.service and .monkeyRansomware file extension.
• Phoenix (Windows backdoor): Second-stage payload distributed via emails in APT espionage campaigns, creates mutex, copies itself for persistence, gathers system info, and communicates with C2 using WinHTTP. Detection via a dropped binary for injection.
• NonEuclid (Windows RAT): C# RAT with persistence, defense bypass (AMSI/Defender), anti-VM, UAC bypass, and optional AES file encryption (.NonEuclid extension), sold as a crimeware kit. Detection via a YARA rule with obfuscated strings and NTSTATUS codes.

1) Monkey (Linux)

Sample: ANY.RUN

Monkey is an x64 ELF ransomware written in Go; it disables Linux protections, establishes persistence (cron/rc.local/systemd), collects and sends system information, changes the wallpaper and places a README with a ransom demand.

How to detect: Malware creates /etc/systemd/system/monkey.service and changes extension to .monkeyRansomware.

Key facts:

• ELF in Go with leftover Windows artifacts in its code (vssadmin etc.) — looks like a poorly made/AI-generated project.

Analytical note:

Detected	External sources	ANY.RUN First Submission	Sandbox Evasion	VT First Submission
2025-10-21	Blog	2025-10-31	3	2025-09-12

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: filePath:"/etc/systemd/system/monkey.service"

IOCs:

• SHA256: 257DE0E2744C99A12CBC1C1B37C76E0E8A010DDE3125EC09468A16E4F8E0F121

• File path: /etc/systemd/system/monkey.service

• File extension: .monkeyRansomware

MITRE:

Technique ID	Technique Name	Evidence
T1547	Boot or Logon Autostart Execution	crontab @reboot; /etc/rc.local modification; /etc/systemd/system/monkey.service.
T1548	Abuse Elevation Control Mechanism	Restart via sudo for privilege escalation.
T1562.001	Impair Defenses: Disable or Modify Tools	pkill -9 selinux, pkill -9 apparmor, systemctl stop firewalld, systemctl stop ufw.
T1082	System Information Discovery	Collection of hostname, MAC, public IP, country; formation of machineId (SHA-256).
T1486	Data Encrypted for Impact	Encrypted files and creating ransom note.

2) Phoenix (Windows)

Sample: ANY.RUN

Phoenix is a backdoor distributed via emails, it's the second stage payload dropped by another malware. This backdoor creates a mutex, copies itself to another folder and modifies registry for persistence, gathers system information (Windows version, username, computer name, domain/workgroup). It uses WinHTTP to communicate with a C2 server.

How to detect: Uses the associated binary file that the malware drops for injection purposes.

Key facts:

• It was used by an APT for an espionage campaign. It also utilizes process injection.

Analytical note:

Detected	External sources	ANY.RUN First Submission	Sandbox Evasion	VT First Submission
2025-10-30	-	2025-10-22	9	2025-10-28

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: registryValue:"sysProcUpdate.exe"

IOCs:

• SHA256: f5694810acaa69ddf7c3507da6d9f4dfb8c53b11fbbe63bc3b56b13579c5870f

• File path: c:\programdata\sysprocupdate.exe

MITRE:

Technique ID	Technique Name	Evidence
T1547.004	Boot or Logon Autostart Execution: Winlogon Helper DLL	Modifies Shell registry value for persistence
T1012	Query Registry	Gathers information about system
T1082	System Information Discovery	Gathers information about system
T1566.001	Spearphishing Attachment	Delivers first stage payload via email attachment
T1055	Process Injection	Injects backdoor payload into process
T1071.001	Application Layer Protocol: Web Protocols	Uses WinHTTP to communicate with C2 server

3) NonEuclid (Windows)

Sample: ANY.RUN

NonEuclid is a Remote Access Trojan (RAT) in C# (.NET Framework 4.8), combining remote management capabilities, persistence, bypassing protections (AMSI/Defender exclusions, anti-VM, anti-process), privilege escalation (UAC bypass) and optionally — file encryption (AES, extension .NonEuclid), i.e. combination of RAT + ransomware functions.

How to detect: Written YARA rule that performs static detection of PE-file by the presence of a set of characteristic Unicode-strings (unique markers/obfuscated identifiers) and by a set of text names of NTSTATUS/system states; triggering occurs if either the entire set of markers is found, or a combination of several markers and a large number of system strings — this indicates a .NET/PE-assembly using Native API and anti-analysis/persistence tricks.

Key facts:

• Combines RAT-possibilities with built-in AES-file encryption (extension .NonEuclid), allowing to switch between "spy" mode and direct encrypting impact. It patches AmsiScanBuffer and adds exclusions to Defender to bypass scanning, and also performs anti-VM checks and terminates work on signs of virtualization. Sold as crimeware-kit with tutorials in underground communities, which accelerates distribution and modifications.

Analytical note:

Detected	External sources	ANY.RUN First Submission	Sandbox Evasion	VT First Submission
2025-11-06	News	2025-09-30	3	2025-09-14

YARA rule for searching in TI Lookup:

rule Noneuclid_RAT
{
    meta:
        description = "Detects Noneuclid RAT. A Remote Access Trojan that uses obfuscated strings and specific Windows NTSTATUS error codes for anti-analysis and persistence"
        author = "ANY.RUN"
        threat = "noneuclid"
        tags = "noneuclid, rat"
        
    strings:
        $x1 = "bibleoteka" ascii wide
        $x2 = "sendbibleoteka" ascii wide
        $x3 = "not admins privilegs" ascii wide
        $x4 = "cogoldokigoldes" ascii wide
        $x5 = "mymuapplesic" ascii wide
        $x6 = "userprogurrufile" ascii wide
        $x7 = "Sy72slst72slem" ascii wide
        $x8 = "C78lsM78lsD78lS" ascii wide
        $x9 = "CUIUSSapibuttontal" ascii wide
        
        $s1 = "MutantNotOwned" ascii wide
        $s2 = "SynchronizationRequired" ascii wide
        $s3 = "VirusInfected" ascii wide
        $s4 = "PipeDisconnected" ascii wide
        $s5 = "LpcReceiveBufferExpected" ascii wide
        $s6 = "TooManyGuidsRequested" ascii wide
        $s7 = "TransactionalOpenNotAllowed" ascii wide
        $s8 = "CurrentTransactionNotValid" ascii wide
        $s9 = "VolumeMounted" ascii wide
        $s10 = "HandleNoLongerValid" ascii wide
        $s11 = "RecoveryNotNeeded" ascii wide
        
    condition:
        uint16(0) == 0x5A4D and
        (
            (all of ($x*)) or
            (4 of ($x*) and 9 of ($s*))
        )
}

IOCs:

• Mutex: piwdiojikylehvkl

• Mutex: mqcpqlvdddbs

• SHA256 (avse67.exe): 34d47457bedbab6c6ff38be86e80ff7f9aa97d799b97a7ad9a9e81bb4d2569e7

MITRE:

Technique ID	Technique Name	Evidence
T1059	Command and Scripting Interpreter	Execution of commands/scripts and dynamic loading of modules (.NET/C# runtime).
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys	Modifications of Run registry keys for persistence.
T1562.001	Impair Defenses: Disable or Modify Tools	Patching AMSI (AmsiScanBuffer) and programmatic addition of exclusions in Windows Defender.
T1497.001	Virtualization/Sandbox Evasion: System Checks	Anti-VM/anti-analysis — environment checks and emergency exit on signs of virtualization.
T1071.001	Application Layer Protocol: Web Protocols	Network connections to C2 (HTTP/TCP) for control and exfiltration.
T1486	Data Encrypted for Impact	AES file encryption with renaming to .NonEuclid.

Conclusion

1) AI-generated malware is emerging

Monkey shows signs of being poorly assembled or AI-generated, with leftover Windows artifacts in a Linux ELF, indicating rapid development and potential for more such threats.

2) Hybrid threats combine RAT and ransomware

NonEuclid's integration of remote access with encryption capabilities highlights evolving crimeware kits that offer versatile attack modes, sold in underground markets.

3) Cross-platform risks increase

From Linux ransomware like Monkey to Windows-focused Phoenix and NonEuclid, threats span operating systems, urging comprehensive security across environments.