The Groups You Haven’t Heard Of Are Still Encrypting Files
Monti, Vice Society, Royal (rebranded as BlackSuit), Cuba, Nokoyawa, Yanluowang, and Lorenz aren’t household names like LockBit or Qilin, but they’re actively compromising businesses in 2026. They target mid-size organizations, school districts, hospitals, and municipal systems — victims that pay quietly and attract less law enforcement scrutiny than Fortune 100 breaches.
Several of these groups trace directly back to Conti, the ransomware operation that shut down in 2022 after its source code leaked. That leak didn’t end the threat; it multiplied it. Royal’s founding members are believed to include former Conti operators. Monti built its earliest payloads almost entirely on Conti’s leaked code. Vice Society doesn’t even write its own ransomware — it reuses existing strains like HelloKitty and Zeppelin.
Staying obscure is deliberate strategy. Vice Society listed 33 different schools on its leak site in a single year by focusing on regional districts that get far less attention than major hospital chains. Lower ransom demands, smaller victims, and a preference for negotiation over publicity all extend these groups’ operational lifespan well past what a prominent gang could expect.
The City of Dallas attack by Royal in June 2023, the CommScope breach by Vice Society that exposed Social Security numbers and bank details for thousands of employees, and Monti’s exploitation of Log4Shell against VMware Horizon systems all followed the same pattern: initial access via phishing, RDP, or vulnerable applications, followed by data exfiltration and file encryption.
Why Signature-Based Detection Fails Against Lesser-Known Groups
Antivirus and EDR tools work by recognizing threats they’ve already seen. A researcher finds a new ransomware variant, analyzes it, creates a signature, pushes an update, and your antivirus learns to block it. That process takes time — hours or days. That window is exactly when attacks happen.
Groups like Monti know this. After a two-month gap in activity in 2023, Monti returned with a Linux-based encryptor that diverged sharply from its original Conti-based code, adding custom behavior specifically designed to evade the detection signatures researchers had built around the earlier variant. Royal rebranded to BlackSuit and kept operating. Vice Society switches between HelloKitty, Zeppelin, and PolyVice payloads.
By the time your signature database catches up, they’ve moved to the next variant or rebranded entirely. You’re playing whack-a-mole with groups that splinter, rebrand, and reuse leaked code faster than vendors can write signatures.
How FileSure Stops Ransomware Without Signatures
FileSure doesn’t try to recognize ransomware. It operates at the Windows kernel level and intercepts file operations before they complete. Ransomware has to write files to your disk — first the payload during initial infection, then encrypted versions of your files during the attack. There’s no way around it.
FileSure controls those write operations. You define a rule: unauthorized programs cannot write executable files to this system. Ransomware delivered via phishing or a vulnerable application tries to write its payload — it’s not an authorized program — and the write is blocked. The payload never lands. The attack stops before it starts.
If a ransomware payload somehow bypasses that first control and begins encrypting files, FileSure’s threshold detection catches it. Ransomware modifies hundreds of files per minute. Normal users don’t. A threshold rule detects the bulk modification pattern and blocks further encryption within seconds.
Here’s a specific FileSure rule configuration that would have stopped the attacks described in this article:
Ransomware Payload Delivery Prevention:
- File name filter:
*.exe, *.dll, *.scr, *.bat, *.ps1 - Program name filter: Allow only authorized deployment tools, installers, and system processes
- Operations: Write, Create
- Drive type: Hard drives, Network drives
- Result: Block unauthorized programs from writing executable files
Ransomware Bulk Encryption Detection:
- File name filter:
*(all files) - Operations: Write, Rename / Move
- Drive type: Hard drives, Network drives, Removable drives
- Threshold: 20 matches within 60 minutes
- Result: Normal file operations pass. Ransomware encryption crosses the threshold within seconds and gets blocked.
A ransomware variant from this morning is stopped the same way as one from five years ago. No signature update required. No waiting for your vendor to catch up. It works on Monti’s custom Linux-targeting encryptor the same way it works on Vice Society’s reused HelloKitty payload.
FileSure runs on legacy and modern Windows systems — Server 2003 through Server 2022, XP through Windows 11. If you have medical equipment, industrial systems, or specialized software locked to an older Windows version, the kind of system that modern endpoint security tools won’t even install on, FileSure protects those too.
The groups that don’t make headlines are betting you’re still waiting for signatures to catch up. Stop waiting. Start your free 21-day trial at bystorm.com.
Source: Lesser-Known Ransomware Groups Still Targeting Businesses
Category: Ransomware
Tags: monti ransomware, vice society, royal ransomware, blacksuit, conti, kernel filter driver, zero-day protection, file system security
