0APT is a ransomware operation first identified in late January 2026 that immediately gained attention by claiming hundreds of victims within its first 48 hours of observed activity. New Halcyon analysis indicates that 0APT:

• Poses a legitimate threat: The gang is aggressive during ransom negotiations and possesses a functional encryption capability that employs robust cryptographic implementation and customizable configurations for exclusion lists, file size limits, parallel processing threads, and memory management parameters.
• Is not a rebrand or directly connected with other known groups: While memory handling and certain encryption elements are consistent with standard encryptors, 0APT does not exhibit significant cross-over with any other ransomware code that Halcyon has analyzed across more than 100+ ransomware variants.
• Likely used inflated or false victim claims to create momentum: Although many of the gang's publicly claimed victims have not been independently verified and some leak-site data has proven non-authentic, inflated victim reporting has historically been used by emerging ransomware operators to establish credibility prior to confirmed attacks.

0APT uses the same code base to run on either Windows or Linux, which are compiled for each victim as shown in 0APT RaaS Panel (for Affiliates) screenshot below:

Ransomware Payload Analysis

Attribute	Details
SHA256 Hashes	388810cade3472336809550d020f210b54cb9479a76c114a66ad371b108a715a ...

Read Full Story: https://news.google.com/rss/articles/CBMisAFBVV95cUxON3RxMnZ3Nm5URVNhY2o0Sm02...