JadePuffer README_RANSOM extortion note creation on compromised database host

Duo Tech@duotech

•updated Jul 8, 2026•5•0•4

This rule monitors for the creation of files containing the string 'readme_ransom' or the execution of processes that reference 'readme_ransom', specific known ransomware wallet addresses, or associated contact email addresses, which are indicative of post-encryption ransomware activity.