LCRYX Ransomware C2 Ping Loop Beaconing to ragebot.fun

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects evidence of LCRYX ransomware activity, specifically identifying beaconing behavior via a 'ping.exe' loop targeting the 'ragebot.fun' domain, and the execution of suspicious Visual Basic scripts (systemconfig.exe.vbs) via wscript or cscript, which are often used for stage-loading malicious payloads.