Makop Ransomware - Specific Threat Actor Email in Filename

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects file modifications containing specific threat actor emails associated with a Makop ransomware variant. This rule looks for file rename or creation events where the filename contains 'stephanielkfujo@web.de' or 'stephanielklfujo@web.de'.