Mimori Ransomware is new. Its operators probably are not.
Report summary
Following the group’s recently observed attack claims Atos Threat Research Center (TRC) identified and secured infrastructure associated with the threat actor, uncovering more than 3,100 operational files that provide rare visibility into how Mimori operates inside compromised environments.
The recovered material reveals a mature and highly automated ransomware operation built around privileged credential access, persistence, network pivoting, lateral movement, and systematic targeting of critical infrastructure. The operators rely extensively on custom Python and shell automation, authenticated proxy infrastructure, remote-access agents, and established offensive tooling to expand and maintain access across victim environments.
The investigation also uncovered activity targeting identity systems, VMware/ESXi environments, and enterprise backup infrastructure, alongside automated data collection and exfiltration workflows using multiple cloud and object storage services. Together, these findings show an operation designed not simply to gain access, but to establish deep control over compromised environments, reduce recovery options, steal valuable data, and create maximum leverage for extortion.
Atos TRC’s latest research provides what we believe to be the first in-depth technical analysis of Mimori, uncovering the ransomware group’s infrastructure, tooling, TTPs, and operational workflow.
Given the volume and complexity of the recovered material, this publication focuses on the most significant findings identified so far. Analysis is ongoing, and the research will be expanded as additional findings emerge from the dataset.