Threat Intelligence / Actor / Femwar02 (BaBlock/Rorschach affiliate)

Femwar02 (BaBlock/Rorschach affiliate)

Nation: Russia · 1 tracked threat(s) · Categories: RANSOMWARE

Also known as: Femwar02, BaBlock operators, Rorschach operators

Tracked threats

BaBlock/Rorschach Ransomware Hits Sapienza University of Rome — Femwar02 Affiliate First Appearance, Fastest Encryption (4m30s), DLL Sideloading via Cortex XDR, Direct Syscalls EDR Evasion, Autonomous AD GPO Propagation, 122K Students Affected, Millions-Euro Ransom — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence