Executive Summary
Makop is a professional Ransomware-as-a-Service (RaaS) operation that has been active since at least 2019, known for employing double extortion tactics. This analysis highlights a sophisticated variant that automates the destruction of system recovery points and uses multi-threaded routines to encrypt local drives and mapped network shares. The malware identifies itself by appending a custom extension containing a unique victim ID and an attacker-controlled contact email.
Technically, the variant features advanced evasion and persistence mechanisms, including activation context manipulation, process injection into legitimate binaries like ntvdm.exe, and the use of malicious modular components such as PwCWSP64.dll. It aggressively targets system backups using built-in Windows utilities and performs anti-forensic memory clearing (memset) to minimize its footprint during execution. Organizations should prioritize securing network shares and monitoring for unauthorized backup administrative commands.