M3rx

M3rx is a financially-motivated cybercriminal group that emerged in late 2024, primarily focused on ransomware operations and data extortion. The group operates a double extortion model, encrypting victim data while simultaneously exfiltrating sensitive information for leverage in ransom negotiations. M3rx has demonstrated a preference for targeting small to medium-sized businesses across multiple sectors, particularly those with limited cybersecurity resources. The group's operations indicate an intermediate level of sophistication, utilizing commercially available and open-source tools combined with custom scripts for initial access and lateral movement. M3rx has been observed leveraging compromised Remote Desktop Protocol (RDP) credentials and exploiting known vulnerabilities in perimeter devices to establish initial footholds in victim networks. Their ransomware payloads show evidence of being based on leaked ransomware builders with moderate customization. M3rx maintains a data leak site on the dark web where they publish stolen data from victims who refuse to pay ransoms. The group's communication style and operational security practices suggest they may be comprised of Russian-speaking actors, though definitive attribution remains challenging. Their ransom demands typically range from $50,000 to $500,000 in cryptocurrency, with negotiations conducted through encrypted chat platforms.