---
title: FBI issues FLASH alert about OnePercent ransomware group
description: In a first for the FBI, their Cyber Division has released a FLASH alert to warn about a ransomware affiliate. The cybercriminals in question are the OnePercent Group, which has operated since at least November 2020 and has ties to the REvil, Maze, and Egregor extortion gangs.
canonical_url: https://www.acronis.com/en/tru/posts/fbi-issues-flash-alert-about-onepercent-ransomware-group/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

27 August 2021

# FBI issues FLASH alert about OnePercent ransomware group

In a first for the FBI, their Cyber Division has released a FLASH alert to warn about a ransomware affiliate. The cybercriminals in question are the OnePercent Group, which has operated since at least November 2020 and has ties to the REvil, Maze, and Egregor extortion gangs.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

[Video 1](https://www.youtube.com/watch?v=e0lPxr-n2FY)

In a first for the FBI, their Cyber Division has released a FLASH alert to warn about a ransomware affiliate. The cybercriminals in question are the OnePercent group, which has operated since at least November 2020 and has ties to the REvil, Maze, and Egregor extortion gangs.

While no specific victims were identified in this alert, it's safe to assume the FBI considers the group to be a serious threat. OnePercent has shown flexibility in the past, jumping between ransomware affiliate programs and quickly adapting to the many changes in the ransomware industry since they appeared on the scene.

OnePercent uses a variety of tools, including the IcedID banking trojan, Cobalt Strike, PowerShell, and AWS S3 cloud, to access systems for the purpose of stealing and encrypting data.

Even when a ransomware affiliate jumps between platforms, the Active Protection included in Acronis Cyber Protect keeps you safe by detecting and blocking all forms of malware based on the malicious behaviors they exhibit.

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)