Obscura
A ransomware variant first reported by Huntress in August 2025, spread through a domain controller share. Coveware found that files over 1GB cannot be recovered, even if a victim pays.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The main lesson is about recovery. Coveware found the encryptor only writes the key material needed for decryption if the file pointer reaches the end of the file. For files over 1GB, that never happens, so those files are permanently lost whether or not the victim pays.2
Proof that a criminal can decrypt can mislead. Coveware says these tests often use small files, so they can miss large-file failures.2
Little is known about who is behind it. Huntress attributes it to no group and found no earlier public references.1 The sources we reviewed do not establish a UK link.
Most servers and databases hold files over 1GB. We would plan as if paying would not restore them, and put the effort into backups.
How It Attacks
Based on one incident described by Huntress, in a network with limited agent coverage.1 Huntress notes this is one deployment method among many.
- 1
Place on the Domain Controller
The binary was placed in the scripts folder behind the NETLOGON share, which replicates between domain controllers. It was named after the victim's domain.
- 2
Run Across Hosts
A scheduled task on multiple hosts ran the binary from that share.
- 3
Open Remote Access
On one machine, a scheduled task enabled Remote Desktop through the firewall.
- 4
Stop What Gets in the Way
Ends about 120 processes tied to security tools, backup, databases, virtualisation and monitoring.
- 5
Encrypt
Deletes shadow copies and encrypts files. It needs administrator rights.
Key Techniques
Our mapping of the behaviour Huntress describes.1 ATT&CK v20 has no entry for this group.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1570 | Lateral Tool Transfer | Lateral Movement | Uses the replicated NETLOGON share to reach hosts. |
| T1053.005 | Scheduled Task | Execution | Runs the binary on multiple hosts. |
| T1036 | Masquerading | Stealth | Names the binary after the victim's domain. |
| T1685 | Disable or Modify Tools | Defense Impairment | Ends processes tied to security tools. |
| T1686 | Disable or Modify System Firewall | Defense Impairment | Allows Remote Desktop through the Windows firewall. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files in full or partial modes. |
Vulnerabilities
The sources we reviewed do not tie a CVE to Obscura.
Warning Signs
From Huntress's advice.1
- New or modified files on domain controllers, including in shared script folders
- New scheduled tasks running binaries from the NETLOGON share
- Unusual access to domain controllers, servers or workstations
Defences That Matter
Watch Domain Controllers
- Monitor domain controllers for new or modified files, including Group Policy objects.1
- Monitor all endpoints for unusual access.1
- Deploy monitoring across the whole estate, as limited coverage restricted the response here.1
Assume Payment Won't Help
- Do not rely on a small-file proof of decryption.2
- Plan for incidents and use independent, variant-aware analysis for ransom decisions.2
- Keep offline or immutable backups of large data stores and test the restore.
Could You Restore Your Largest Systems?
We can help you test recovery for the systems that matter most.
Sources
- Huntress: Obscura, an Obscure New Ransomware Variant, 2 September 2025
- Coveware by Veeam: Obscura Ransomware: A Case Study in Ransomware Data Loss, 19 November 2025, updated 24 March 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.