FunkSec
FunkSec represents a new wave of AI-assisted ransomware groups, blending cybercrime with hacktivism. While their technical sophistication is questionable, their tactics and public visibility make them a notable threat. Security teams should monitor AI-driven malware trends and prepare for ransomware attacks leveraging automation and deception tactics.
FunkSec's Background
FunkSec is a ransomware group that emerged in late 2024, rapidly gaining notoriety for its high number of publicly claimed victims. Unlike other established ransomware gangs, FunkSec appears to be a relatively new and independent operation, with no known ties to previous ransomware families. The group utilizes double extortion tactics, combining data encryption with data theft to pressure victims into paying ransoms.
A key characteristic of FunkSec is its AI-assisted malware development, allowing even inexperienced actors to rapidly create and iterate on malicious tools. The group appears to operate at the intersection of hacktivism and cybercrime, making it difficult to determine their true motivations. Some of their leaked datasets were found to be recycled from previous hacktivist campaigns, casting doubt on the authenticity of their disclosures.
While FunkSec presents itself as a sophisticated ransomware-as-a-service (RaaS) operation, security researchers have identified multiple signs indicating that the group's technical expertise is limited. Most of their activities seem to be driven by a desire for notoriety rather than financial gain, as evidenced by their low ransom demands and public promotional efforts on cybercrime forums.
Source: Checkpoint
Targets
FunkSec's Targets
Targeted Countries
The majority of FunkSec's claimed victims have been from India and the United States, with additional attacks targeting European and Middle Eastern organizations. Their alignment with the "Free Palestine" movement suggests a possible geopolitical motivation, though this may be more about branding than actual political intent.
Targeted Industries
FunkSec does not appear to focus on a single industry but has attacked government institutions, healthcare, financial services, and technology companies. The group's ransomware-as-a-service (RaaS) model allows multiple affiliates to use their tools, broadening their scope of potential victims. Some targeted industries align with hacktivist motives, particularly government agencies and infrastructure.
Image source: PCrisk
Targeted Industries
FunkSec does not appear to focus on a single industry but has attacked government institutions, healthcare, financial services, and technology companies. The group's ransomware-as-a-service (RaaS) model allows multiple affiliates to use their tools, broadening their scope of potential victims. Some targeted industries align with hacktivist motives, particularly government agencies and infrastructure.
Image source: PCrisk
Notable Victims
An estimated 138 organizations have fallen prey to FunkSec attacks.
Attack Method
FunkSec's attack method
FunkSec gains access through phishing emails, credential stuffing, and exploiting unpatched vulnerabilities in exposed systems. They also leverage stolen credentials found in dark web forums.
The group attempts to escalate privileges using credential theft techniques, token manipulation, and exploiting misconfigurations in Windows environments.
FunkSec disables Windows Defender, event logging, and PowerShell security features to avoid detection. Their ransomware is compiled in Rust, which can make analysis and detection more difficult.
They deploy keyloggers and password-scraping tools like funkgenerate, which gathers credentials from compromised systems and websites.
FunkSec scans infected networks to locate valuable files and determine the most critical assets to encrypt.
They use HVNC (hidden virtual network computing) tools and remote desktop exploits to move across compromised networks.
The group exfiltrates sensitive files using custom Python scripts and standard tools like Rclone before encrypting the victim’s data.
The Rust-based ransomware encrypts files using ChaCha20 encryption, appends the “.funksec” extension, and drops a ransom note.
Stolen data is uploaded to FunkSec’s dark web leak site, where it is either publicly released or sold to third parties.
The ransomware deletes shadow copies, disrupts operations by terminating processes, and changes system settings (e.g., blacking out the desktop background).
Initial Access
FunkSec gains access through phishing emails, credential stuffing, and exploiting unpatched vulnerabilities in exposed systems. They also leverage stolen credentials found in dark web forums.
Privilege Escalation
The group attempts to escalate privileges using credential theft techniques, token manipulation, and exploiting misconfigurations in Windows environments.
Defense Evasion
FunkSec disables Windows Defender, event logging, and PowerShell security features to avoid detection. Their ransomware is compiled in Rust, which can make analysis and detection more difficult.
Credential Access
They deploy keyloggers and password-scraping tools like funkgenerate, which gathers credentials from compromised systems and websites.
Discovery
FunkSec scans infected networks to locate valuable files and determine the most critical assets to encrypt.
Lateral Movement
They use HVNC (hidden virtual network computing) tools and remote desktop exploits to move across compromised networks.
Collection
The group exfiltrates sensitive files using custom Python scripts and standard tools like Rclone before encrypting the victim’s data.
Execution
The Rust-based ransomware encrypts files using ChaCha20 encryption, appends the “.funksec” extension, and drops a ransom note.
Exfiltration
Stolen data is uploaded to FunkSec’s dark web leak site, where it is either publicly released or sold to third parties.
Impact
The ransomware deletes shadow copies, disrupts operations by terminating processes, and changes system settings (e.g., blacking out the desktop background).
MITRE ATT&CK Mapping
FunkSec's TTPs
TA0001: Initial Access
T1566
Phishing
T1190
Exploit Public-Facing Application
TA0002: Execution
T1204
User Execution
TA0003: Persistence
No items found.
TA0004: Privilege Escalation
T1134
Access Token Manipulation
T1068
Exploitation for Privilege Escalation
TA0005: Defense Evasion
T1134
Access Token Manipulation
T1070
Indicator Removal
T1562
Impair Defenses
TA0006: Credential Access
T1110
Brute Force
T1003
OS Credential Dumping
TA0007: Discovery
T1082
System Information Discovery
T1046
Network Service Discovery
TA0008: Lateral Movement
T1021
Remote Services
TA0009: Collection
No items found.
TA0011: Command and Control
No items found.
TA0010: Exfiltration
T1567
Exfiltration Over Web Service
TA0040: Impact
T1490
Inhibit System Recovery
T1486
Data Encrypted for Impact
Platform Detections