A newly discovered ransomware variant named “Mamona” is gaining attention for its stealthy, offline nature and its unusual use of Windows’ ping functionality as part of its execution strategy.
In contrast to typical ransomware that relies on internet connectivity to coordinate with external servers, Mamona executes its entire payload locally. This offline mode of operation allows it to fly under the radar of conventional network-based detection systems.
“Mamona represents a shift in tactics—away from sophisticated infrastructures and toward streamlined, self-contained threats,” said cybersecurity researcher Mauro Eldritch. “It doesn’t need to phone home to be dangerous, and that makes it harder to track and block.”
One of Mamona’s defining characteristics is its “silent” behavior. It avoids creating digital noise by skipping traditional Command and Control communication, and there’s no sign of data being extracted from infected machines.
To further cloak its presence, the ransomware uses a built-in delay method involving pinging an obscure loopback IP address—127.0.0.7—instead of the more typical 127.0.0.1. This subtle switch may help it slip past security rules that flag more common behaviors.
Mamona underscores a growing pattern in ransomware development: prioritizing ease of deployment and evasion over technical sophistication—without compromising the threat it poses to organizations.
Mamona Ransomware’s Stealth Routine & Evasion Techniques
Mamona initiates its attack with a deceptive simplicity, executing a tightly sequenced set of local commands designed to minimize its footprint. At the outset, it hijacks the Windows ping utility—not for network diagnostics, but as a makeshift delay function that stalls execution just long enough to obfuscate activity in real time.
Immediately after this delay, Mamona turns inward, issuing a command to erase its own executable (del /f /q), effectively covering its tracks and thwarting traditional forensic efforts.
“This use of system-native tools for both timing and self-deletion demonstrates a minimalist but effective evasion design,” said cybersecurity expert Mauro Eldritch. “Rather than relying on external infrastructure or advanced obfuscation layers, Mamona operates like a disappearing act—quick, quiet, and hard to trace.”
Mamona’s Recon, Encryption Process, and Ransom Deployment
Mamona begins its intrusion by quietly gathering essential host details—such as the system’s name and regional language settings—laying the groundwork for a tailored attack without triggering alerts.
Instead of relying on conventional cryptographic libraries, Mamona takes a more opaque approach. It encrypts files using a self-constructed algorithm built from scratch, relying on direct memory access and raw arithmetic logic. This unconventional method not only obscures its workings but also complicates decryption and analysis.
Infected files are marked with the “.HAes” suffix (e.g., invoice.xlsx → invoice.xlsx.HAes), and a ransom demand—“README.HAes.txt”—is systematically planted across various folders to ensure visibility.
🔍 Want to watch it in action? Explore Mamona and other threats in real-time with ANY.RUN’s interactive sandbox, built for hands-on malware analysis.
Mamona: Loud on Threats, Silent on Traffic
Once inside a system, Mamona wastes no time making its presence known—it replaces the desktop background with a stark warning: “Your files have been encrypted!”
The ransom note claims dire consequences, including the threat of data leaks. However, technical analysis reveals no outbound network traffic or data exfiltration. “It’s all bark, no byte,” noted researchers. “This appears to be psychological leverage, not a technical capability.”
Mamona is suspected to be the latest evolution from actors formerly behind the BlackLock campaigns, who have also been tied to the Embargo ransomware. Its profile rose after the DragonForce group allegedly resumed operations following BlackLock’s dismantling in March 2025.
Despite its use of substandard encryption techniques, Mamona remains dangerous because of its simplicity and complete offline functionality—traits that make it an ideal tool for inexperienced threat actors. The ransomware poses a heightened risk to small and mid-sized organizations lacking advanced threat detection capabilities.
Fortunately, defenders have a lifeline: a functional decryption tool has been released. Though visually outdated, it successfully recovers affected files in most known cases.
Mamona’s rise highlights a worrying shift in cybercrime—away from complex, resource-intensive campaigns and toward plug-and-play ransomware kits that even low-skill attackers can wield effectively. It’s not just about sophistication anymore—it’s about accessibility and scale.
