“Onyx,” an emerging ransomware operation, has been identified destroying accessed files that are larger than two (2) megabytes (MBs) rather than encrypting them. Onyx, who currently has six (6) victims on their leak site, has been observed exfiltrating data from compromised systems, encrypting devices, and utilizing the stolen data in double-extortion schemes, which is typical for ransomware operations. This destruction technique, however, is not common. The technique was identified by MalwareHunterTeam, who gained a sample of the ransomware’s encryptor and documented their observations on Twitter. MalwareHunterTeam stated “the ransomware [Onyx] are using is a trash skidware, it’s destroying a part of the victims’ files,” meaning that files are being overwritten with “ransom junk data,” as opposed to encrypting the data. This technique prevents the victim from decrypting the files despite a ransom being paid to the operation. Jiří Vinopal, a forensic and malware analyst, also added that the Onyx decryptor does not account for larger files. While MalwareHunterTeam also noted that the ransom note is “mostly a copy-paste of Conti’s note,” there is speculation that the reviewed code is based on the Chaos ransomware (which includes an identical destruction encryption routine). CTIX analysts will continue to monitor Onyx’s tactics, techniques, and procedures (TTPs) as the operation evolves.