---
title: "Decoding the Puzzle: Cicada3301 Ransomware Threat Analysis"
description: In this blog Morphisec researchers provide a comprehensive analysis of a prevented Cicada3301 ransomware attack in a customer environment.
image: https://www.morphisec.com/hubfs/Cicada3301%20Ransomware_1200x628_v.1.0%20%281%29.png
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Decoding the Puzzle: Cicada3301 Ransomware Threat Analysis

Posted by [Michael Gorelik](https://1534169.hs-sites.com/author/michael-gorelik) on September 3, 2024

Find me on:

[LinkedIn](https://www.linkedin.com/in/michael-gorelik-56130021) [Twitter ](https://twitter.com/smgoreli)

- [Tweet](https://twitter.com/share)

In the rapidly evolving landscape of cybersecurity threats, a new adversary has emerged, drawing inspiration from one of the internet’s most enigmatic puzzles—Cicada3301. This new threat, dubbed Cicada3301 ransomware, was identified in a Morphisec customer environment just a week ago after bypassing a leading endpoint and detection and response (EDR) provider solution.  

![Cicada3301 Ransomware_1200x628_v.1.0 (1)](https://www.morphisec.com/hubfs/Cicada3301%20Ransomware_1200x628_v.1.0%20(1).png)

## Introduction

Cicada3301 ransomware, written in Rust, was [first reported less than two months ago](https://thecyberexpress.com/tri-star-display-cyberattack/). Despite its recent emergence, Morphisec threat researchers have already identified striking similarities between Cicada3301 and the infamous [BlackCat ransomware](https://blog.morphisec.com/mgm-resorts-alphv-spider-ransomware-attack).  

Like its namesake, the Cicada puzzle, which has long been associated with complex, cyber-related problem-solving, the true identity of the Cicada3301 ransomware developers remains shrouded in mystery. 

However, it's crucial to note that Morphisec's [anti-ransomware impact protection](https://www.morphisec.com/ransomware-prevention) has already proven effective against Cicada3301 without requiring any updates, highlighting Morphisec’s robustness and adaptability in the face of emerging threats. 

During Morphisec’s investigation, additional tools were uncovered, such as EDRSandBlast, which is used to tamper with EDR systems. With the limited visibility Morphisec researchers currently have, it appears that Cicada3301 ransomware primarily targets small to medium-sized businesses (SMBs), likely through opportunistic attacks that exploit vulnerabilities as the initial access vector. 

![Welcome-to-Cicada3301](https://www.morphisec.com/hubfs/Welcome-to-Cicada3301.png)

Since June 18, 2024, Morphisec has counted more than 20 victims, predominately located in North America and England. Impacted organizations vary in size, from SMB (13 organizations) and mid-sized businesses (5 organizations) to enterprise (3). Industries of operation include manufacturing/industrial, healthcare, retail and hospitality. Attackers accept payment in Bitcoin and Monero. 

 

![Cicada3301 Ransomware Message](https://www.morphisec.com/hubfs/Cicada3301Message-ezgif.com-png-to-webp-converter.webp)

## **Technical Details** 

**Cicada3301 **ransomware shares several core characteristics with the well-known Rust-based ransomware, **BlackCat**. 

It features a well-defined parameter configuration interface, registers a vector exception handler, and employs similar methods for shadow copy deletion and tampering. This trend of using Rust in ransomware development is on the rise, with other notable examples including **Hive **and **RansomExx**, due to Rust's efficiency and cross-platform capabilities. 

However, Cicada3301 distinguishes itself with significant innovations, particularly in how it executes and integrates compromised credentials, marking an evolution in ransomware tactics. 

 

### [**Download Morphisec’s full Cicada3301 analysis including Indicators of Compromise (IOCs) **](https://engage.morphisec.com/threat-analysis-cicada3301) 

[![Cicada3301 Ransomware_800x200_v.1.1_CTA](https://www.morphisec.com/hubfs/Cicada3301%20Ransomware_800x200_v.1.1_CTA.png)](https://engage.morphisec.com/threat-analysis-cicada3301)

 

## **How Morphisec Helps** 

Powered by [Automated Moving Target Defense (AMTD)](https://www.morphisec.com/moving-target-defense), Morphisec’s [Anti-Ransomware Assurance Suite](https://1534169.hs-sites.com/introducing-anti-ransomware-assurance-suite) stops ransomware attacks like Cicada3301 with multi-layered protection. 

**Ransomware infiltration protection** prevents the execution of ransomware attacks at early infiltration stages with Morphisec’s prevention-first AMTD technology that constantly changes a system’s configuration or environment. This makes it harder for attackers to exploit systems as the attack surface is always shifting. 

**Ransomware impact protection** defends systems against the ransomware impact phase with dedicated anti-ransomware protection that proactively defends critical assets and files with a prevention-first strategy. This minimizes recovery times and strengthens an organization’s anti-ransomware stance. 

Preventatively, **Adaptive Exposure Management** (AEM) helps teams adapt by pre-emptively defending against attacks. AEM prioritizes vulnerabilities, automates the assessment and validation of an organization’s security controls, identifies high-risk software and addresses security misconfigurations. 

Morphisec doesn’t rely on signature or behavioral patterns. Instead, its patented [AMTD](https://www.morphisec.com/products/) technology prevents an attack at its earliest stages, preemptively blocking attacks on memory and applications, and effectively remediating the need for response.   

 

[**Schedule a demo**](https://www.morphisec.com/schedule)** today to see how Morphisec stops ransomware and other new and emerging threats.**    

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/c0c8d819-c7bc-43c9-a80b-7db9c88cd5ab.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/c0c8d819-c7bc-43c9-a80b-7db9c88cd5ab)

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/cicada3301-ransomware-threat-analysis#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Michael Gorelik",
    "url" : "https://1534169.hs-sites.com/author/michael-gorelik"
  },
  "dateModified" : "2024-09-03T13:00:00.305Z",
  "datePublished" : "2024-09-03T13:00:00.000Z",
  "headline" : "Decoding the Puzzle: Cicada3301 Ransomware Threat Analysis",
  "image" : [ "https://www.morphisec.com/hubfs/Cicada3301%20Ransomware_1200x628_v.1.0%20%281%29.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/cicada3301-ransomware-threat-analysis",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```