Threat actorRussiaTracked since 2026-02

Femwar02

Also known as:BaBlock operatorsRorschach operators

As of 2026-05-30, Femwar02 is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning ransomware. Also known as BaBlock operators, Rorschach operators.

Tracked threats: 11 high
First seen: 2026-022026-02-02
Last seen: 2026-022026-02-02
ATT&CK techniques: —No mapped techniques yet
Related CVEs: 0None referenced
Attribution: RussiaNation or origin

Nation: Russia · 1 tracked threat(s) · Categories: RANSOMWARE

Activity timeline

Femwar02 appears in 1 tracked threat between 2026-02-02 and 2026-02-02.

Tracked threats

BaBlock/Rorschach Ransomware Hits Sapienza University of Rome — Femwar02 Affiliate First Appearance, Fastest Encryption (4m30s), DLL Sideloading via Cortex XDR, Direct Syscalls EDR Evasion, Autonomous AD GPO Propagation, 122K Students Affected, Millions-Euro RansomHIGH2026-02-02