Eclipse ransomware - Tradecraft exposed through a leaked C2 server

Report summary

In early October 2026, the Atos Threat Research Center discovered a C2 server belonging to Eclipse, a financially motivated Ransomware-as-a-Service group that emerged in mid-August 2026 on dark web forums. The server was not a disposable C2 node - it was a shared toolbox containing the group's complete working inventory: encryptors for three platforms, exploit scripts, credential harvesting tools, exfiltration infrastructure, and evidence of active campaigns against seven organizations across five countries.

This kind of visibility into a ransomware operation is exceptionally rare. Most of what defenders know about these groups comes from fragments collected after the damage is already done. Here, everything was in one place.

"Streamer" - A custom post-exploitation framework

The most significant artifact is a previously undocumented Rust framework called "Streamer" - a single 21 MB binary with over 250 offensive modules covering credential theft, Active Directory reconnaissance, Kerberos attacks, lateral movement, process injection, evasion, and pivoting. An embedded LuaJIT scripting engine allows operators to extend capabilities at runtime. No C2 framework by this name appears in any public threat intelligence. The standalone copies of Mimikatz, Rubeus, and Chisel found alongside it appear to be legacy fallbacks largely made redundant by Streamer's native functionality.

Weaponized Trend Micro Binaries

Three distinct Trend Micro products were repurposed as payload carriers, with encrypted Streamer beacons embedded in their resource sections. Eclipse rotated across TM products as detection rates increased - from 23/71 on VirusTotal for the earliest variant down to zero submissions for the latest. Two custom keyloggers complemented the delivery chain, one specifically targeting CDK Global automotive dealership software.

Targeting backup and virtualization infrastructure

Exploit scripts for VMware ESXi (CVE-2021-21974) and Veeam Backup Enterprise Manager (CVE-2024-29849) were recovered alongside PowerShell scripts that extract and decrypt credentials from Veeam's SQL database. Both are adapted from public proof-of-concept code. Compromising this infrastructure expands access through harvested credentials while removing the victim's recovery options before encryption begins.

Structured data exfiltration

Data theft is built around Wasabi S3 cloud storage with dedicated per-victim buckets, bandwidth-capped transfers to avoid network alerts, and automated watchdog scripts that restart exfiltration up to 50 times. Three complete campaigns were recovered targeting organizations in Chile, the United States, and Brazil. A stolen Google Workspace service account key revealed a fourth victim in Ireland.

Post-quantum encryption - no flaws found

All three encryptor variants - Windows, Linux, and ESXi - implement Kyber768 + ChaCha20 with per-file random keys. No private keys were recovered and no implementation weaknesses were identified. The Windows variant self-spreads via WMI, remote service creation, and GPO-based scheduled tasks while strategically keeping vCenter, pfSense, and domain controllers alive to preserve propagation infrastructure.

Why this matters

The full 26-page analysis includes a detailed breakdown of every tool and technique recovered from the server, along with comprehensive Indicators of Compromise across network, Windows Event Log, EDR/Sysmon, Active Directory, and Linux/ESXi layers - everything defenders need to identify an Eclipse intrusion before encryption starts.

Read the full research (opens in a new tab)