Ransomware Gangs Utilize Skitnet Malware for Post-Exploitation Activities

Several ransomware groups are using a malware called Skitnet in their post-exploitation efforts to steal sensitive data and establish remote control over compromised hosts. According to the Swiss cybersecurity company PRODAFT, Skitnet has been sold on underground forums like RAMP since April 2024. However, since early 2025, several ransomware operators have been observed using this malware.