Obscura: A Stealthy New Go-Based Ransomware Is Abusing Domain Controllers

Obscura is a stealthy new Go-based ransomware discovered by security analysts at Huntress, named for its README_Obscura.txt ransom note. The malware targets corporate networks by placing itself in the NETLOGON folder of the domain controller, enabling automatic deployment across the infrastructure through domain controller replication.

It runs with administrative privileges and uses scheduled tasks such as SystemUpdate, while also enabling Remote Desktop Protocol via firewall changes to widen control over compromised endpoints, according to Huntress. Technical features include Curve25519 with XChaCha20 encryption and an OBSCURA! footer appended to each encrypted file, with the note warning victims of a 240-hour window and that all information has been stolen.

The campaign reportedly shows some signs of lateral movement but no propagation code beyond domain controller deployment, and Obscura is described as one of several newer ransomware variants observed recently, including Crux and Cephalus. According to Huntress, organisations should monitor domain controllers for new or modified files and changes to GPOs to detect the threat.