“Redeemer”, a ransomware builder produced by “Cerebrate” who provides Ransomware-as-a-Service (RaaS) operations, has been recently updated to version 2.0. Cerebrate’s services are generally promoted to unsophisticated threat actors on hacking forums. Redeemer 2.0 is written in the C++ programming language and can be used on Windows Vista, 7, 8, 10, and 11. This operation is unlike many others since the ransomware itself is free of charge, though Redeemer’s developer receives a 20% cut of ransoms paid from attacks using the ransomware. This is achieved through a new campaign ID tracking system, which facilitates affiliates to track various campaigns as well as set a specific ID to the executable to ensure the integrity of the set ransom amount in Monero. Redeemer’s operator also “shares the master key to be combined with the private builder key held by the affiliate for decryption.” Version 2.0 also features a new graphical user interface and instructions on how to build the ransomware executable and decryption tool in a ZIP folder. Cyble researchers released a report on July 20, 2022, which detailed additional Redeemer 2.0 functionality, such as a modified ransom message, the addition of using XMPP Chat/Tox Chat/up to two (2) emails for communication, a new icon for encrypted files, and various small fixes. Researchers also identified the ransomware first creates a mutex called “RedeemerMutex” to “ensure that only one instance of malware is running on the victim’s machine” and then “creates a folder, copies itself into the Windows directory with legitimate file names, …and executes itself as a new process by using the ShellExecuteW() API function.” Redeemer 2.0 also launches various Windows Event Utility commands to clear all event logs before encrypting victim files, deletes “the shadow copies, backup catalog, and system state backups,” as well as kills all actively running processes on the victim machine. An in-depth analysis of Redeemer 2.0 as well as indicators of compromise (IOCs) can be viewed in Cyble’s report linked below.