Makop Ransomware Turns Inward: Why India Has Become the Global Ground Zero

Executive Summary

Recent findings from the Acronis Threat Research Unit indicate a decisive operational shift by the Makop ransomware group, with India now accounting for approximately 55% of all global Makop victims. This concentration is highly abnormal by ransomware standards and strongly suggests a deliberate, region-focused campaign rather than opportunistic global spraying.

What makes this campaign particularly concerning is not just the volume of Indian victims, but the degree of customization observed. Makop operators have adapted their tooling, malware delivery chain, and defense evasion techniques specifically to the Indian cybersecurity ecosystem, including the targeted removal of Quick Heal Antivirus, which is widely deployed across Indian SMEs.

This report consolidates the attack chain, tooling, indicators, and defensive gaps being exploited, with a focus on practical implications for Indian organizations.

1. Strategic Shift in Attack Methodology

From Manual Deployment to Multi-Stage Malware Delivery

Historically, Makop relied on manual, hands-on-keyboard ransomware deployment after gaining access to victim networks. In the December 2025 campaign, this changed.

For the first time, Makop operators integrated GuLoader, a well-known and highly evasive malware downloader, into their attack chain.

Why this matters:

GuLoader enables automated, stealthy payload delivery
It allows attackers to deploy info-stealers before ransomware
Detection is harder because GuLoader often masquerades as legitimate executables

This evolution moves Makop closer to the operational maturity seen in larger ransomware-as-a-service (RaaS) groups.

2. Initial Access: Still Simple, Still Effective

Despite advanced tooling later in the chain, Makop’s entry point remains basic.

Primary Infection Vector: Exposed RDP

Internet-facing RDP services (TCP 3389) remain the main entry point
Attackers use automated scanners and brute-force tools to identify:
- Weak passwords
- No MFA
- No VPN restrictions

Acronis researchers describe Makop as “opportunistic”: they prioritize targets that require minimal effort. The high victim count in India strongly suggests:

Widespread exposed RDP
Poor password hygiene
Limited MFA adoption, especially among SMEs

In many cases, attackers create hidden or backup user accounts after access is gained to maintain persistence.

3. GuLoader: The New First-Stage Payload

Once access is established, attackers deploy GuLoader.

Role of GuLoader in Makop Attacks

GuLoader acts as a shellcode-based downloader, responsible for:

Fetching secondary malware
Bypassing traditional signature-based detection
Staging the environment before ransomware execution

Common evasion techniques observed:

Polyglot file formats
Fake filenames mimicking system utilities:
- taskmgr.exe
- svchost.exe
- bug_hand.exe
Placement in non-standard directories:
- %TEMP%
- %APPDATA%
- Music / Video folders

Secondary Payloads Delivered

Before encryption, GuLoader has been observed deploying:

AgentTesla
FormBook
XLoader
LokiBot

This allows attackers to:

Steal credentials
Capture keystrokes and screenshots
Exfiltrate data for resale or double-extortion leverage

Even if a ransom is not paid, the attackers still monetize the breach.

4. Region-Specific Weaponization: Targeting Indian Defenses

Custom Quick Heal Antivirus Removal

The most alarming development is the discovery of custom-built uninstaller tools designed specifically to remove Quick Heal Antivirus.

This is significant because:

Quick Heal is predominantly used in India
Such tooling has little value outside the region
It confirms intentional targeting, not coincidence

This level of localization is rarely seen outside high-value geopolitical or financially motivated campaigns.

5. Defense Evasion via BYOVD (Bring Your Own Vulnerable Driver)

To ensure security tools stay disabled, Makop relies heavily on BYOVD techniques.

How the BYOVD Attack Works

Attackers drop a legitimate, signed driver with known vulnerabilities
Windows allows it to load due to trusted signatures
The vulnerability is exploited to gain kernel-level (Ring 0) access
From kernel space, attackers forcibly terminate:
- Antivirus
- EDR
- Backup agents

Drivers Observed in Makop Campaigns

hlpdrv.sys
- Allows arbitrary kernel memory access
ThrottleStop.sys (CVE-2025-7771)
- Originally a CPU monitoring driver
- Abused to manipulate kernel memory
Process Hacker / PCHunter drivers
- Used to kill protected processes

Once kernel access is achieved, modern EDR protections become largely ineffective.

6. Living-Off-the-Land and Credential Harvesting

Makop blends malicious activity with legitimate tools to avoid detection.

Legitimate Tools Abused

Process Hacker / IOBitUnlocker
- Terminate locked services (SQL, Exchange, AV)
AnyDesk / Splashtop
- Persistent remote access
NSudo
- Elevated command execution

Credential Theft

To move laterally, attackers deploy:

Mimikatz
LaZagne

These tools extract:

Cached credentials
Cleartext passwords
Domain credentials (if available)

This enables rapid spread across internal networks.

7. Privilege Escalation Exploits Observed

Makop operators carry a wide exploit toolkit, targeting both old and recent vulnerabilities to maximize success.

CVE	Description
CVE-2016-0099	Secondary Logon LPE
CVE-2019-0803	Win32k Kernel LPE
CVE-2021-41379	Windows Installer EoP
CVE-2022-24521	CLFS Driver LPE
CVE-2024-XXXX	Various kernel & spooler exploits

The presence of very old CVEs highlights how often legacy, unpatched systems are still found in Indian SME environments.

8. Final Impact: Encryption and Destruction

Before encryption, attackers execute:

vssadmin delete shadows /all /quiet

This removes Volume Shadow Copies, preventing easy recovery.

Encryption Indicators

Extensions:
- .makop
- .AIR
- .f69
Filename format: originalfile.[VictimID].[email].makop
Ransom Note:
- +README-WARNING+.txt
- Dropped in every directory and on the desktop

9. Key Indicators of Compromise (IOC Summary)

File & Registry

+README-WARNING+.txt
Registry Run key with numeric names (e.g., "1")
Mutex examples: m23071644 (varies)

Processes

Unexpected termination of:
- sql.exe
- exchange.exe
- veeam.exe
- AV / EDR agents

Drivers

Presence of:
- hlpdrv.sys
- ThrottleStop.sys
- kprocesshacker.sys

10. Defensive Guidance (Priority Actions)

Immediate

Disconnect affected systems immediately if compromise is suspected
Hunt for GuLoader activity, not just ransomware binaries

RDP Hardening (Critical)

Remove RDP from public internet exposure
Enforce:
- VPN access
- MFA
- Strong password policies

Detection Improvements

Alert on execution of:
- Process Hacker
- PCHunter
- NSudo
Monitor for vulnerable driver loading (BYOVD indicators)

Patch Management

Prioritize kernel, driver, VPN, and firewall patches
Legacy systems are high-risk and actively targeted

Final Takeaway

Makop’s December 2025 campaign marks a clear evolution from a simple ransomware operation into a regionally adapted threat actor. The targeted dismantling of Indian security products, combined with loader-based malware delivery and kernel-level evasion, places this campaign among the most concerning threats currently facing Indian SMEs.

Makop is not exploiting zero-days — it is exploiting basic security gaps at scale.