Makop ransomware

A ransomware operation active since about 2020 and related to the broader Phobos/Crysis ecosystem. Operators commonly exploit exposed remote services or compromised credentials, encrypt files, and leave individualized ransom notes to negotiate payment.