{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1486","id":"T1486","name":"Data Encrypted for Impact","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1486","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"a0e205c5eed82a079f20a69bef658cfc4922e2e7ada94a02c175d3399a5ac672","description":"Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)\n\nIn the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529), in order to unlock and/or gain access to manipulate these files.(Citation: CarbonBlack Conti July 2020) In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017) Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) \n\nTo maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017) Encryption malware may also leverage [Internal Defacement](https://attack.mitre.org/techniques/T1491/001), such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as \"print bombing\").(Citation: NHS Digital Egregor Nov 2020)(Citation: Varonis)\n\nIn cloud environments, storage objects within compromised accounts may also be encrypted.(Citation: Rhino S3 Ransomware Part 1) For example, in AWS environments, adversaries may leverage services such as AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data.(Citation: Halcyon AWS Ransomware 2025)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1486","external_id":"T1486"},{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"},{"source_name":"FireEye WannaCry 2017","description":"Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"},{"source_name":"Rhino S3 Ransomware Part 1","description":"Gietzen, S. (n.d.). S3 Ransomware Part 1: Attack Vector. Retrieved April 14, 2021.","url":"https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/"},{"source_name":"Halcyon AWS Ransomware 2025","description":"Halcyon RISE Team. (2025, January 13). Abusing AWS Native Services: Ransomware Encrypting S3 Buckets with SSE-C. Retrieved March 18, 2025.","url":"https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c"},{"source_name":"Varonis","description":"Jason Hill. (2023, February 8). VMware ESXi in the Line of Ransomware Fire. Retrieved March 26, 2025.","url":"https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire"},{"source_name":"Crowdstrike Hypervisor Jackpotting Pt 2 2021","description":"Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.","url":"https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"},{"source_name":"NHS Digital Egregor Nov 2020","description":"NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"},{"source_name":"US-CERT Ransomware 2016","description":"US-CERT. (2016, March 31). Alert (TA16-091A): Ransomware and Recent Variants. Retrieved March 15, 2019.","url":"https://www.us-cert.gov/ncas/alerts/TA16-091A"},{"source_name":"US-CERT NotPetya 2017","description":"US-CERT. (2017, July 1). Alert (TA17-181A): Petya Ransomware. Retrieved March 15, 2019.","url":"https://www.us-cert.gov/ncas/alerts/TA17-181A"},{"source_name":"US-CERT SamSam 2018","description":"US-CERT. (2018, December 3). Alert (AA18-337A): SamSam Ransomware. Retrieved March 15, 2019.","url":"https://www.us-cert.gov/ncas/alerts/AA18-337A"}],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0023","name":"Cloud Storage Modification","page":"telemetry/DC0023/","kind":"attack_component","category":"Cloud storage","description":"Changes to cloud storage configuration, permissions or stored objects.","collection_focus":"Collect storage policy/ACL changes and relevant write data events; preserve before/after state where available.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":null,"required_fields":["resource","action","public_access_before","public_access_after","change_ticket"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0023","collector":"illustrative-lab-collector","observation":{"resource":"lab-bucket","action":"change_policy","public_access_before":false,"public_access_after":false,"change_ticket":"LAB-42"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1486","id":"T1486","name":"Data Encrypted for Impact","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1486","technique_page":"techniques/enterprise/T1486/","page":"detections/enterprise/T1486/","status":"rule_source_available","counts":{"sigma":10,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"4c6ca276-d4d0-4a8c-9e4c-d69832f8671f","title":"Antivirus Ransomware Detection","status":"test","level":"critical","logsource":{"category":"antivirus"},"data_path":"data/detection-rules/4c6ca276-d4d0-4a8c-9e4c-d69832f8671f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/category/antivirus/av_ransomware.yml","author":"Florian Roth (Nextron Systems), Arnim Rupp","kind":"sigma"},{"id":"16124c2d-e40b-4fcc-8f2c-5ab7870a2223","title":"AWS EC2 Disable EBS Encryption","status":"stable","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/16124c2d-e40b-4fcc-8f2c-5ab7870a2223.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml","author":"Sittikorn S","kind":"sigma"},{"id":"1279262f-1464-422f-ac0d-5b545320c526","title":"AWS KMS Imported Key Material Usage","status":"experimental","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/1279262f-1464-422f-ac0d-5b545320c526.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_kms_import_key_material.yml","author":"toopricey","kind":"sigma"},{"id":"bd132164-884a-48f1-aa2d-c6d646b04c69","title":"Microsoft 365 - Potential Ransomware Activity","status":"test","level":"medium","logsource":{"service":"threat_management","product":"m365"},"data_path":"data/detection-rules/bd132164-884a-48f1-aa2d-c6d646b04c69.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml","author":"austinsonger","kind":"sigma"},{"id":"e3f673b3-65d1-4d80-9146-466f8b63fa99","title":"Suspicious Appended Extension","status":"test","level":"medium","logsource":{"product":"windows","category":"file_rename","definition":"Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword"},"data_path":"data/detection-rules/e3f673b3-65d1-4d80-9146-466f8b63fa99.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_rename/file_rename_win_ransomware.yml","author":"frack113","kind":"sigma"},{"id":"b48492dc-c5ef-4572-8dff-32bc241c15c8","title":"Load Of RstrtMgr.DLL By A Suspicious Process","status":"test","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/b48492dc-c5ef-4572-8dff-32bc241c15c8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml","author":"Luc Génaux","kind":"sigma"},{"id":"3669afd2-9891-4534-a626-e5cf03810a61","title":"Load Of RstrtMgr.DLL By An Uncommon Process","status":"test","level":"low","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/3669afd2-9891-4534-a626-e5cf03810a61.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml","author":"Luc Génaux","kind":"sigma"},{"id":"77df53a5-1d78-4f32-bc5a-0e7465bd8f41","title":"Portable Gpg.EXE Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/77df53a5-1d78-4f32-bc5a-0e7465bd8f41.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"0e0255bf-2548-47b8-9582-c0955c9283f5","title":"Suspicious Reg Add BitLocker","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0e0255bf-2548-47b8-9582-c0955c9283f5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_bitlocker.yml","author":"frack113","kind":"sigma"},{"id":"ec0722a3-eb5c-4a56-8ab2-bf6f20708592","title":"Renamed Gpg.EXE Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ec0722a3-eb5c-4a56-8ab2-bf6f20708592.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_gpg4win.yml","author":"Nasreddine Bencherchali (Nextron Systems), frack113","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1486-1","technique_id":"T1486","title":"T1486 Data Encrypted for Impact","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#impact","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":189,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L189","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"17827c8fe6c562c8f947ede428f4483f4f3ebbed3e11fc3af3692fc58946829d","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(file_write_or_rename BY process, 5m) >= threshold AND DISTINCT_COUNT(file_extension BY process, 5m) >= threshold -> ALERTMATCH(known_ransomware_signature) -> ALERT","log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"},{"title":"Antivirus and Antimalware Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#135-antivirus-and-antimalware-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1486-1","technique_id":"T1486","title":"Files encrypted for impact — T1486 Data Encrypted for Impact","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#ransomware-encryption","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":119,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L119","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"8a0bcb64c041b5ed633c4b78c0ac546469ba55f0e31ba94b4c64c9a8aa3e3e8f","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"process file-operation stream and file population.","expected_behavior":"ordinary processes modify limited file sets with stable extension distributions.","deviation":"sudden high-volume writes, extension-distribution shift, and cascading impact across directories.","anomaly_types":[{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"},{"title":"Categorical-Distribution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#87-categorical-distribution-anomaly"},{"title":"Cascading Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#114-cascading-anomaly"}],"log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"}],"context_references":[{"title":"Play ransomware joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-352a-play-ransomware.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231218.pdf"}]}],"anomaly_types":[{"title":"Cascading Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#114-cascading-anomaly"},{"title":"Categorical-Distribution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#87-categorical-distribution-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}],"strategies":[{"id":"DET0215","name":"Detection of Multi-Platform File Encryption for Impact","url":"https://attack.mitre.org/detectionstrategies/DET0215","stix_id":"x-mitre-detection-strategy--d080a1b1-5ad1-45a1-8f7b-b736986c20d9","relationship_id":"relationship--245046a7-adc8-4a5a-84b4-e0af6c3b8dc7","description":"","analytics":[{"id":"AN0602","name":"Analytic 0602","guidance":"High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.","url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0602","platforms":["Windows"],"tuning":[{"field":"FileExtension","description":"Non-standard or randomly generated file extensions may indicate encrypted content."},{"field":"TargetFolder","description":"Focus on user document folders, network shares, or system paths like %System32%."},{"field":"TimeWindow","description":"Correlate rapid writes and renames within seconds across high file count."},{"field":"CommandLine","description":"Flag common ransomware tools or functions (vssadmin delete shadows /all /quiet)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0602","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0602","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0602","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0602","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0061","component":"File Modification","name":"WinEventLog:Sysmon","channel":"EventCode=2","platforms":["Windows"],"analytic_id":"AN0602","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0602","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN0603","name":"Analytic 0603","guidance":"Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.","url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0603","platforms":["Linux"],"tuning":[{"field":"FilenamePattern","description":"Look for creation of ransom note files (e.g., READ_ME.txt, HELP_DECRYPT.html)."},{"field":"SyscallBurstRate","description":"High write/open/unlink activity in short intervals indicates encryption attempts."},{"field":"DirectoryTargeted","description":"Correlate activity in /home, /etc, /opt, or mounted volumes."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"openat, write, rename, unlink","platforms":["Linux"],"analytic_id":"AN0603","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0603","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0603","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0603","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0604","name":"Analytic 0604","guidance":"Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using `srm`, `gpg`, or compiled payloads. Often correlated with ransom note creation in multiple directories.","url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0604","platforms":["macOS"],"tuning":[{"field":"ExtensionPattern","description":"Encrypted files may use .locked, .enc, or ransom-specific extensions."},{"field":"VolumeTargeted","description":"Detect activity targeting mounted external or backup volumes."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"macos:unifiedlog","channel":"file encrypted|new file with .encrypted extension|disk write burst","platforms":["macOS"],"analytic_id":"AN0604","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0604","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"exec srm|exec openssl|exec gpg","platforms":["macOS"],"analytic_id":"AN0604","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0604","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0605","name":"Analytic 0605","guidance":"Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through `dcui`, SSH, or vSphere.","url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0605","platforms":["ESXi"],"tuning":[{"field":"FileType","description":"Detect renames or write patterns involving .vmdk, .vmx, .nvram."},{"field":"UserContext","description":"Identify shell sessions opened by root or unexpected users outside maintenance window."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"esxi:vmkernel","channel":"rename .vmdk to .*.locked|datastore write spike","platforms":["ESXi"],"analytic_id":"AN0605","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0605","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"openssl|tar|dd","platforms":["ESXi"],"analytic_id":"AN0605","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0605","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0606","name":"Analytic 0606","guidance":"Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.","url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0606","platforms":["IaaS"],"tuning":[{"field":"SSEHeader","description":"SSE-C headers indicate attacker-controlled encryption keys."},{"field":"AffectedBucket","description":"Prioritize logs, backups, or shared document storage buckets."},{"field":"UserAgent","description":"Detect scripted automation vs console-based API behavior."}],"log_sources":[{"component_id":"DC0023","component":"Cloud Storage Modification","name":"AWS:CloudTrail","channel":"PutObject (with SSE-C), UploadPart (SSE-C)","platforms":["IaaS"],"analytic_id":"AN0606","source_url":"https://attack.mitre.org/detectionstrategies/DET0215#AN0606","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0023/"}]}]}],"telemetry_references":[{"id":"DC0023","name":"Cloud Storage Modification","tag":"Cloud Storage Modification","page":"telemetry/DC0023/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) has an operational mode for encrypting data instead of overwriting it.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)","relationship_id":"relationship--d7f4f6eb-05b8-43af-8d8a-e06b1d950165","references":[{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"Unit 42 Shamoon3 2018","description":"Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.","url":"https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) encrypts the victims machine followed by asking the victim to pay a ransom. (Citation: SecureList SynAck Doppelgänging May 2018)","relationship_id":"relationship--8c1c7c51-f9bf-4163-a01b-7d922a2d1a93","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"}]},{"id":"S0341","name":"Xbash","url":"https://attack.mitre.org/software/S0341","kind":"malware","description":"[Xbash](https://attack.mitre.org/software/S0341) has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.(Citation: Unit42 Xbash Sept 2018)","relationship_id":"relationship--98ccbadd-dbfa-44d3-b3f2-3a55c8fa37e1","references":[{"source_name":"Unit42 Xbash Sept 2018","description":"Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"}]},{"id":"S0366","name":"WannaCry","url":"https://attack.mitre.org/software/S0366","kind":"malware","description":"[WannaCry](https://attack.mitre.org/software/S0366) encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.(Citation: LogRhythm WannaCry)(Citation: FireEye WannaCry 2017)(Citation: SecureWorks WannaCry Analysis)","relationship_id":"relationship--5c56206f-8ae3-4296-ab89-bc2036b74896","references":[{"source_name":"FireEye WannaCry 2017","description":"Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"},{"source_name":"SecureWorks WannaCry Analysis","description":"Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.","url":"https://www.secureworks.com/research/wcry-ransomware-analysis"},{"source_name":"LogRhythm WannaCry","description":"Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved December 8, 2024.","url":"https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"}]},{"id":"S0368","name":"NotPetya","url":"https://attack.mitre.org/software/S0368","kind":"malware","description":"[NotPetya](https://attack.mitre.org/software/S0368) encrypts user files and disk structures like the MBR with 2048-bit RSA.(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)","relationship_id":"relationship--aac8f64e-54d1-4aad-80ee-dd3cd887f30e","references":[{"source_name":"Talos Nyetya June 2017","description":"Chiu, A. (2016, June 27). New Ransomware Variant \"Nyetya\" Compromises Systems Worldwide. Retrieved March 26, 2019.","url":"https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"},{"source_name":"US-CERT NotPetya 2017","description":"US-CERT. (2017, July 1). Alert (TA17-181A): Petya Ransomware. Retrieved March 15, 2019.","url":"https://www.us-cert.gov/ncas/alerts/TA17-181A"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"S0370","name":"SamSam","url":"https://attack.mitre.org/software/S0370","kind":"malware","description":"[SamSam](https://attack.mitre.org/software/S0370) encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.(Citation: Sophos SamSam Apr 2018)","relationship_id":"relationship--ac263a26-1773-4ac1-b81b-b29f9ace484a","references":[{"source_name":"Sophos SamSam Apr 2018","description":" Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.","url":"https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-ransomware-chooses-Its-targets-carefully-wpna.pdf"}]},{"id":"S0372","name":"LockerGoga","url":"https://attack.mitre.org/software/S0372","kind":"malware","description":"[LockerGoga](https://attack.mitre.org/software/S0372) has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)(Citation: Wired Lockergoga 2019)","relationship_id":"relationship--31daba72-fb27-45a9-9224-991032b605a8","references":[{"source_name":"CarbonBlack LockerGoga 2019","description":"CarbonBlack Threat Analysis Unit. (2019, March 22). TAU Threat Intelligence Notification – LockerGoga Ransomware. Retrieved April 16, 2019.","url":"https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/"},{"source_name":"Unit42 LockerGoga 2019","description":"Harbison, M. (2019, March 26). Born This Way? Origins of LockerGoga. Retrieved April 16, 2019.","url":"https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/"},{"source_name":"Wired Lockergoga 2019","description":"Greenberg, A. (2019, March 25). A Guide to LockerGoga, the Ransomware Crippling Industrial Firms. Retrieved July 17, 2019.","url":"https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/"}]},{"id":"S0389","name":"JCry","url":"https://attack.mitre.org/software/S0389","kind":"malware","description":"[JCry](https://attack.mitre.org/software/S0389) has encrypted files and demanded Bitcoin to decrypt those files. (Citation: Carbon Black JCry May 2019)","relationship_id":"relationship--164aec0b-1e3e-4e79-b9c3-43d602a1674a","references":[{"source_name":"Carbon Black JCry May 2019","description":"Lee, S.. (2019, May 14). JCry Ransomware. Retrieved June 18, 2019.","url":"https://www.carbonblack.com/2019/05/14/cb-tau-threat-intelligence-notification-jcry-ransomware-pretends-to-be-adobe-flash-player-update-installer/"}]},{"id":"S0400","name":"RobbinHood","url":"https://attack.mitre.org/software/S0400","kind":"malware","description":"[RobbinHood](https://attack.mitre.org/software/S0400) will search for an RSA encryption key and then perform its encryption process on the system files.(Citation: CarbonBlack RobbinHood May 2019) ","relationship_id":"relationship--e2fd8460-85cf-42b3-acee-7151758ee55a","references":[{"source_name":"CarbonBlack RobbinHood May 2019","description":"Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019.","url":"https://www.carbonblack.com/2019/05/17/cb-tau-threat-intelligence-notification-robbinhood-ransomware-stops-181-windows-services-before-encryption/"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.(Citation: CrowdStrike Ryuk January 2019)(Citation: CrowdStrike Wizard Spider October 2020)","relationship_id":"relationship--adbb2fb8-9a9f-4068-b123-7b557491861d","references":[{"source_name":"CrowdStrike Ryuk January 2019","description":"Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"},{"source_name":"CrowdStrike Wizard Spider October 2020","description":"Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. [Maze](https://attack.mitre.org/software/S0449) has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.(Citation: FireEye Maze May 2020)","relationship_id":"relationship--006e029e-0714-4f99-befd-53b9fbc7c8c8","references":[{"source_name":"FireEye Maze May 2020","description":"Kennelly, J., Goody, K., Shilko, J. (2020, May 7). Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents. Retrieved May 18, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html"}]},{"id":"S0457","name":"Netwalker","url":"https://attack.mitre.org/software/S0457","kind":"malware","description":"[Netwalker](https://attack.mitre.org/software/S0457) can encrypt files on infected machines to extort victims.(Citation: TrendMicro Netwalker May 2020)\t","relationship_id":"relationship--b9a67332-54a8-4531-948f-51e3ae2a0399","references":[{"source_name":"TrendMicro Netwalker May 2020","description":"Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"}]},{"id":"S0481","name":"Ragnar Locker","url":"https://attack.mitre.org/software/S0481","kind":"malware","description":"[Ragnar Locker](https://attack.mitre.org/software/S0481) encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.(Citation: Sophos Ragnar May 2020)(Citation: Cynet Ragnar Apr 2020)","relationship_id":"relationship--05951058-e8d4-4ace-a6b8-54735c6a4769","references":[{"source_name":"Sophos Ragnar May 2020","description":"SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.","url":"https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"},{"source_name":"Cynet Ragnar Apr 2020","description":"Gold, B. (2020, April 27). Cynet Detection Report: Ragnar Locker Ransomware. Retrieved June 29, 2020.","url":"https://www.cynet.com/blog/cynet-detection-report-ragnar-locker-ransomware/"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can encrypt files on victim systems and demands a ransom to decrypt the files.(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Talos Sodinokibi April 2019)(Citation: McAfee REvil October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)(Citation: Tetra Defense Sodinokibi March 2020)","relationship_id":"relationship--1c30f3e0-f621-4e59-934d-f4091cb9eca5","references":[{"source_name":"Talos Sodinokibi April 2019","description":"Cadieux, P, et al (2019, April 30). Sodinokibi ransomware exploits WebLogic Server vulnerability. Retrieved August 4, 2020.","url":"https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"},{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Cylance Sodinokibi July 2019","description":"Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Kaspersky Sodin July 2019","description":"Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"Picus Sodinokibi January 2020","description":"Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.","url":"https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"},{"source_name":"McAfee REvil October 2019","description":"Saavedra-Morales, J, et al. (2019, October 20). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo. Retrieved August 5, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"},{"source_name":"Tetra Defense Sodinokibi March 2020","description":"Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.(Citation: NHS Digital Egregor Nov 2020)(Citation: Cybereason Egregor Nov 2020) ","relationship_id":"relationship--a3eb4cec-8053-4830-b256-e46748dba3d9","references":[{"source_name":"NHS Digital Egregor Nov 2020","description":"NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"},{"source_name":"Cybereason Egregor Nov 2020","description":"Rochberger, L. (2020, November 26). Cybereason vs. Egregor Ransomware. Retrieved December 30, 2020.","url":"https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware"}]},{"id":"S0556","name":"Pay2Key","url":"https://attack.mitre.org/software/S0556","kind":"malware","description":"[Pay2Key](https://attack.mitre.org/software/S0556) can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.(Citation: ClearkSky Fox Kitten February 2020)(Citation: Check Point Pay2Key November 2020)","relationship_id":"relationship--9a8d5690-94b9-46d2-a383-6f26a3c25c80","references":[{"source_name":"ClearkSky Fox Kitten February 2020","description":"ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/fox-kitten/"},{"source_name":"Check Point Pay2Key November 2020","description":"Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}]},{"id":"S0570","name":"BitPaymer","url":"https://attack.mitre.org/software/S0570","kind":"malware","description":"[BitPaymer](https://attack.mitre.org/software/S0570) can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending <code>.locked</code> to the filename.(Citation: Crowdstrike Indrik November 2018)","relationship_id":"relationship--4c8da471-3483-4f75-8e1a-952d2d05454d","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) can use <code>CreateIoCompletionPort()</code>, <code>PostQueuedCompletionStatus()</code>, and <code>GetQueuedCompletionPort()</code> to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. [Conti](https://attack.mitre.org/software/S0575) can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020)(Citation: Cybleinc Conti January 2020)(Citation: CrowdStrike Wizard Spider October 2020)(Citation: DFIR Conti Bazar Nov 2021)","relationship_id":"relationship--97ef26b5-5dda-458b-926e-933ec0d099d6","references":[{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"},{"source_name":"Cybleinc Conti January 2020","description":"Cybleinc. (2021, January 21). Conti Ransomware Resurfaces, Targeting Government & Large Organizations. Retrieved April 13, 2021.","url":"https://cybleinc.com/2021/01/21/conti-ransomware-resurfaces-targeting-government-large-organizations/"},{"source_name":"DFIR Conti Bazar Nov 2021","description":"DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"},{"source_name":"CrowdStrike Wizard Spider October 2020","description":"Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"},{"source_name":"Cybereason Conti Jan 2021","description":"Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware"}]},{"id":"S0576","name":"MegaCortex","url":"https://attack.mitre.org/software/S0576","kind":"malware","description":"[MegaCortex](https://attack.mitre.org/software/S0576) has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.(Citation: IBM MegaCortex)(Citation: mbed-crypto)","relationship_id":"relationship--8b245546-d5ed-4ff8-b5a6-7c97250ce026","references":[{"source_name":"IBM MegaCortex","description":"Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"},{"source_name":"mbed-crypto","description":"ARMmbed. (2018, June 21). Mbed Crypto. Retrieved February 15, 2021.","url":"https://github.com/ARMmbed/mbed-crypto"}]},{"id":"S0583","name":"Pysa","url":"https://attack.mitre.org/software/S0583","kind":"malware","description":"[Pysa](https://attack.mitre.org/software/S0583) has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.(Citation: CERT-FR PYSA April 2020) ","relationship_id":"relationship--7893dc40-721b-4455-b411-3ccda7f4a3a2","references":[{"source_name":"CERT-FR PYSA April 2020","description":"CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}]},{"id":"S0595","name":"ThiefQuest","url":"https://attack.mitre.org/software/S0595","kind":"malware","description":"[ThiefQuest](https://attack.mitre.org/software/S0595) encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.(Citation: wardle evilquest partii)","relationship_id":"relationship--02c4488b-6041-4222-9363-18a63ce3b835","references":[{"source_name":"wardle evilquest partii","description":"Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.","url":"https://objective-see.com/blog/blog_0x60.html"}]},{"id":"S0605","name":"EKANS","url":"https://attack.mitre.org/software/S0605","kind":"malware","description":"[EKANS](https://attack.mitre.org/software/S0605) uses standard encryption library functions to encrypt files.(Citation: Dragos EKANS)(Citation: Palo Alto Unit 42 EKANS)","relationship_id":"relationship--36106fcd-5f7f-47b9-8a45-1faa89d2ba36","references":[{"source_name":"Dragos EKANS","description":"Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.","url":"https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"},{"source_name":"Palo Alto Unit 42 EKANS","description":"Hinchliffe, A. Santos, D. (2020, June 26). Threat Assessment: EKANS Ransomware. Retrieved February 9, 2021.","url":"https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/"}]},{"id":"S0606","name":"Bad Rabbit","url":"https://attack.mitre.org/software/S0606","kind":"malware","description":"[Bad Rabbit](https://attack.mitre.org/software/S0606) has encrypted files and disks using AES-128-CBC and RSA-2048.(Citation: Secure List Bad Rabbit)","relationship_id":"relationship--0252fc3f-1bf0-433f-b619-b874137f84f3","references":[{"source_name":"Secure List Bad Rabbit","description":"Mamedov, O. Sinitsyn, F.  Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021.","url":"https://securelist.com/bad-rabbit-ransomware/82851/"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.(Citation: KillDisk Ransomware)","relationship_id":"relationship--c6cfaa54-2ce3-40c8-af91-cd09e6e9c167","references":[{"source_name":"KillDisk Ransomware","description":"Catalin Cimpanu. (2016, December 29). KillDisk Disk-Wiping Malware Adds Ransomware Component. Retrieved January 12, 2021.","url":"https://www.bleepingcomputer.com/news/security/killdisk-disk-wiping-malware-adds-ransomware-component/"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) can encrypt files using AES, RSA, and RC4 and will add the \".clop\" extension to encrypted files.(Citation: Mcafee Clop Aug 2019)(Citation: Unit42 Clop April 2021)(Citation: Cybereason Clop Dec 2020) ","relationship_id":"relationship--c7daa7ca-ca5a-4940-a370-d9eccb8f3c9a","references":[{"source_name":"Mcafee Clop Aug 2019","description":"Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"},{"source_name":"Unit42 Clop April 2021","description":"Santos, D. (2021, April 13). Threat Assessment: Clop Ransomware. Retrieved July 30, 2021.","url":"https://unit42.paloaltonetworks.com/clop-ransomware/"},{"source_name":"Cybereason Clop Dec 2020","description":"Cybereason Nocturnus. (2020, December 23). Cybereason vs. Clop Ransomware. Retrieved May 11, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware"}]},{"id":"S0612","name":"WastedLocker","url":"https://attack.mitre.org/software/S0612","kind":"malware","description":"[WastedLocker](https://attack.mitre.org/software/S0612) can encrypt data and leave a ransom note.(Citation: Symantec WastedLocker June 2020)(Citation: NCC Group WastedLocker June 2020)(Citation: Sentinel Labs WastedLocker July 2020) ","relationship_id":"relationship--6c1ca5ac-fa01-44f3-997c-ef8b28dc22f3","references":[{"source_name":"Symantec WastedLocker June 2020","description":"Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"},{"source_name":"NCC Group WastedLocker June 2020","description":"Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"},{"source_name":"Sentinel Labs WastedLocker July 2020","description":"Walter, J.. (2020, July 23). WastedLocker Ransomware: Abusing ADS and NTFS File Attributes. Retrieved September 14, 2021.","url":"https://www.sentinelone.com/labs/wastedlocker-ransomware-abusing-ads-and-ntfs-file-attributes/"}]},{"id":"S0616","name":"DEATHRANSOM","url":"https://attack.mitre.org/software/S0616","kind":"malware","description":"[DEATHRANSOM](https://attack.mitre.org/software/S0616) can use public and private key pair encryption to encrypt files for ransom payment.(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--34c6a059-9496-4f1e-9331-c1986e62b6a1","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0617","name":"HELLOKITTY","url":"https://attack.mitre.org/software/S0617","kind":"malware","description":"[HELLOKITTY](https://attack.mitre.org/software/S0617) can use an embedded RSA-2048 public key to encrypt victim data for ransom.(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--4765866e-48c9-48f7-a2c0-cb1251680b56","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0618","name":"FIVEHANDS","url":"https://attack.mitre.org/software/S0618","kind":"malware","description":"[FIVEHANDS](https://attack.mitre.org/software/S0618) can use an embedded NTRU public key to encrypt data for ransom.(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)(Citation: NCC Group Fivehands June 2021)","relationship_id":"relationship--93f1d277-685d-46ee-a796-a50641364fbc","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"},{"source_name":"NCC Group Fivehands June 2021","description":"Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.","url":"https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) has the ability to encrypt system data and add the \".cuba\" extension to encrypted files.(Citation: McAfee Cuba April 2021) ","relationship_id":"relationship--2212e364-d161-49ba-9a3f-a4e9e2260b2e","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) can use ChaCha8 and ECDH to encrypt data.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Medium Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)","relationship_id":"relationship--18355c9b-c3e8-4bc7-a389-425e5d7c6351","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","description":"Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"},{"source_name":"McAfee Babuk February 2021","description":"Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"},{"source_name":"Medium Babuk February 2021","description":"Sebdraven. (2021, February 8). Babuk is distributed packed. Retrieved August 11, 2021.","url":"https://sebdraven.medium.com/babuk-is-distributed-packed-78e2f5dd2e62"},{"source_name":"Trend Micro Ransomware February 2021","description":"Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.","url":"https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"}]},{"id":"S0639","name":"Seth-Locker","url":"https://attack.mitre.org/software/S0639","kind":"malware","description":"[Seth-Locker](https://attack.mitre.org/software/S0639) can encrypt files on a targeted system, appending them with the suffix .seth.(Citation: Trend Micro Ransomware February 2021)","relationship_id":"relationship--d4221b38-c9cf-4773-9a49-afa7b07b917a","references":[{"source_name":"Trend Micro Ransomware February 2021","description":"Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.","url":"https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) encrypts the victim system using a combination of AES256 and RSA encryption schemes.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--b844f979-ddd2-4def-8d07-89b56ef10713","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0654","name":"ProLock","url":"https://attack.mitre.org/software/S0654","kind":"malware","description":"[ProLock](https://attack.mitre.org/software/S0654) can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.(Citation: Group IB Ransomware September 2020)","relationship_id":"relationship--3e3df746-053d-42e6-95c7-3f99c31be8be","references":[{"source_name":"Group IB Ransomware September 2020","description":"Group IB. (2020, September). LOCK LIKE  A PRO. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"}]},{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658) performs AES-CBC encryption on files under <code>~/Documents</code>, <code>~/Downloads</code>, and\n<code>~/Desktop</code> with a fixed key and renames files to give them a <code>.enc</code> extension. Only files with sizes \nless than 500MB are encrypted.(Citation: trendmicro xcsset xcode project 2020)","relationship_id":"relationship--cb043548-a193-4ade-b69d-d83e3378d255","references":[{"source_name":"trendmicro xcsset xcode project 2020","description":"Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) has encrypted files using an RSA key though the `CryptEncrypt` API and has appended filenames with \".lock64\". (Citation: Fortinet Diavol July 2021)","relationship_id":"relationship--1e549632-405c-49fc-8594-3666ad22c681","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S1033","name":"DCSrv","url":"https://attack.mitre.org/software/S1033","kind":"malware","description":"[DCSrv](https://attack.mitre.org/software/S1033) has encrypted drives using the core encryption mechanism from DiskCryptor.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--696c0ce2-7829-4d95-baab-ae64db59c62a","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has encrypted files and network resources using AES-256 and added an `.avos`, `.avos2`, or `.AvosLinux` extension to filenames.(Citation: Malwarebytes AvosLocker Jul 2021)(Citation: Trend Micro AvosLocker Apr 2022)(Citation: Cisco Talos Avos Jun 2022)(Citation: Joint CSA AvosLocker Mar 2022)","relationship_id":"relationship--40861c0e-9cbc-4355-a7c0-cc0405c70b82","references":[{"source_name":"Joint CSA AvosLocker Mar 2022","description":"FBI, FinCEN, Treasury. (2022, March 17). Indicators of Compromise Associated with AvosLocker Ransomware. Retrieved January 11, 2023.","url":"https://www.ic3.gov/Media/News/2022/220318.pdf"},{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"},{"source_name":"Trend Micro AvosLocker Apr 2022","description":"Trend Micro Research. (2022, April 4). Ransomware Spotlight AvosLocker. Retrieved January 11, 2023.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker"},{"source_name":"Cisco Talos Avos Jun 2022","description":"Venere, G. Neal, C. (2022, June 21). Avos ransomware group expands with new attack arsenal. Retrieved January 11, 2023.","url":"https://blog.talosintelligence.com/avoslocker-new-arsenal/"}]},{"id":"S1058","name":"Prestige","url":"https://attack.mitre.org/software/S1058","kind":"malware","description":"[Prestige](https://attack.mitre.org/software/S1058) has leveraged the CryptoPP C++ library to encrypt files on target systems using AES and appended filenames with `.enc`.(Citation: Microsoft Prestige ransomware October 2022)","relationship_id":"relationship--2a28ee8a-0ecd-43da-a4f8-a653ef5fd123","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) has the ability to encrypt Windows devices, Linux devices, and VMWare instances.(Citation: Microsoft BlackCat Jun 2022)","relationship_id":"relationship--29cec373-a87c-444b-b192-9ab94f69a008","references":[{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) can encrypt files with the ChaCha20 cypher and using a multithreaded process to increase speed.(Citation: Minerva Labs Black Basta May 2022)(Citation: BlackBerry Black Basta May 2022)(Citation: Cyble Black Basta May 2022)(Citation: NCC Group Black Basta June 2022)(Citation: Uptycs Black Basta ESXi June 2022)(Citation: Deep Instinct Black Basta August 2022)(Citation: Palo Alto Networks Black Basta August 2022)(Citation: Trend Micro Black Basta Spotlight September 2022)(Citation: Check Point Black Basta October 2022) [Black Basta](https://attack.mitre.org/software/S1070) has also encrypted files while the victim system is in safe mode, appending `.basta` upon completion.(Citation: Trend Micro Black Basta May 2022) ","relationship_id":"relationship--6aedddc0-0c82-48f0-b9cc-071d440a367c","references":[{"source_name":"BlackBerry Black Basta May 2022","description":"Ballmer, D. (2022, May 6). Black Basta: Rebrand of Conti or Something New?. Retrieved March 7, 2023.","url":"https://blogs.blackberry.com/en/2022/05/black-basta-rebrand-of-conti-or-something-new"},{"source_name":"Check Point Black Basta October 2022","description":"Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023.","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"},{"source_name":"Cyble Black Basta May 2022","description":"Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Palo Alto Networks Black Basta August 2022","description":"Elsad, A. (2022, August 25). Threat Assessment: Black Basta Ransomware. Retrieved March 8, 2023.","url":"https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware"},{"source_name":"Trend Micro Black Basta May 2022","description":"Gonzalez, I., Chavez I., et al. (2022, May 9). Examining the Black Basta Ransomware’s Infection Routine. Retrieved March 7, 2023.","url":"https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"},{"source_name":"NCC Group Black Basta June 2022","description":"Inman, R. and Gurney, P. (2022, June 6). Shining the Light on Black Basta. Retrieved March 8, 2023.","url":"https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"},{"source_name":"Uptycs Black Basta ESXi June 2022","description":"Sharma, S. and Hegde, N. (2022, June 7). Black basta Ransomware Goes Cross-Platform, Now Targets ESXi Systems. Retrieved March 8, 2023.","url":"https://www.uptycs.com/blog/black-basta-ransomware-goes-cross-platform-now-targets-esxi-systems"},{"source_name":"Trend Micro Black Basta Spotlight September 2022","description":"Trend Micro. (2022, September 1). Ransomware Spotlight Black Basta. Retrieved March 8, 2023.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta"},{"source_name":"Deep Instinct Black Basta August 2022","description":"Vilkomir-Preisman, S. (2022, August 18). Beating Black Basta Ransomware. Retrieved March 8, 2023.","url":"https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"},{"source_name":"Minerva Labs Black Basta May 2022","description":"Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023.","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) uses a multi-threaded encryption process that can partially encrypt targeted files with the OpenSSL library and the AES256 algorithm.(Citation: Cybereason Royal December 2022)(Citation: Kroll Royal Deep Dive February 2023)(Citation: Trend Micro Royal Linux ESXi February 2023)","relationship_id":"relationship--11e07c1f-4b28-459f-92db-ab4ebe1c5740","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"},{"source_name":"Kroll Royal Deep Dive February 2023","description":"Iacono, L. and Green, S. (2023, February 13). Royal Ransomware Deep Dive. Retrieved March 30, 2023.","url":"https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive"},{"source_name":"Trend Micro Royal Linux ESXi February 2023","description":"Morales, N. et al. (2023, February 20). Royal Ransomware Expands Attacks by Targeting Linux ESXi Servers. Retrieved March 30, 2023.","url":"https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html"}]},{"id":"S1096","name":"Cheerscrypt","url":"https://attack.mitre.org/software/S1096","kind":"malware","description":"[Cheerscrypt](https://attack.mitre.org/software/S1096) can encrypt data on victim machines using a Sosemanuk stream cipher with an Elliptic-curve Diffie–Hellman (ECDH) generated key.(Citation: Trend Micro Cheerscrypt May 2022)(Citation: Sygnia Emperor Dragonfly October 2022)\n","relationship_id":"relationship--50fc9c04-4251-43f3-8c88-3fc58a3b4b5b","references":[{"source_name":"Sygnia Emperor Dragonfly October 2022","description":"Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source_name":"Trend Micro Cheerscrypt May 2022","description":"Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.","url":"https://www.trendmicro.com/en_se/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) can deploy follow-on ransomware payloads.(Citation: Ensilo Darkgate 2018)","relationship_id":"relationship--27b82cee-dbc4-44c9-9f00-2168b8921a27","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}]},{"id":"S1129","name":"Akira","url":"https://attack.mitre.org/software/S1129","kind":"malware","description":"[Akira](https://attack.mitre.org/software/S1129) can encrypt victim filesystems for financial extortion purposes including through the use of the ChaCha20 and ChaCha8 stream ciphers.(Citation: Kersten Akira 2023)(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)\n","relationship_id":"relationship--fde26c5e-7f17-4119-b5d1-86a7fbe4a184","references":[{"source_name":"CISA Akira Ransomware APR 2024","description":"CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source_name":"Kersten Akira 2023","description":"Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024.","url":"https://www.trellix.com/blogs/research/akira-ransomware/"},{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"id":"S1133","name":"Apostle","url":"https://attack.mitre.org/software/S1133","kind":"malware","description":"[Apostle](https://attack.mitre.org/software/S1133) creates new, encrypted versions of files then deletes the originals, with the new filenames consisting of a random GUID and \".lock\" for an extension.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--e0a19456-e5f7-4b08-884d-188a9fc173ef","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1137","name":"Moneybird","url":"https://attack.mitre.org/software/S1137","kind":"malware","description":"[Moneybird](https://attack.mitre.org/software/S1137) targets a common set of file types such as documents, certificates, and database files for encryption while avoiding executable, dynamic linked libraries, and similar items.(Citation: CheckPoint Agrius 2023)","relationship_id":"relationship--187b15ea-f564-4abf-80d8-756115f47be2","references":[{"source_name":"CheckPoint Agrius 2023","description":"Marc  Salinas Fernandez & Jiri  Vinopal. (2023, May 23). AGRIUS DEPLOYS MONEYBIRD IN TARGETED ATTACKS AGAINST ISRAELI ORGANIZATIONS. Retrieved May 21, 2024.","url":"https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-israeli-organizations/"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) can encrypt data on victim systems, including through the use of partial encryption and multi-threading to speed encryption.(Citation: SentinelOne INC Ransomware)(Citation: Huntress INC Ransom Group August 2023)(Citation: Cybereason INC Ransomware November 2023)(Citation: SOCRadar INC Ransom January 2024)(Citation: SentinelOne INC Ransomware)","relationship_id":"relationship--7d8dcd8d-3ca4-4464-b8ab-9dee24f93c70","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source_name":"SentinelOne INC Ransomware","description":"SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source_name":"SOCRadar INC Ransom January 2024","description":"SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024.","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source_name":"Huntress INC Ransom Group August 2023","description":"Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"id":"S1150","name":"ROADSWEEP","url":"https://attack.mitre.org/software/S1150","kind":"malware","description":"[ROADSWEEP](https://attack.mitre.org/software/S1150) can RC4 encrypt content in blocks on targeted systems.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)","relationship_id":"relationship--5f408271-9f8a-4eab-ac54-a8c81be61724","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","description":"CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"},{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"},{"source_name":"Microsoft Albanian Government Attacks September 2022","description":"MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"}]},{"id":"S1162","name":"Playcrypt","url":"https://attack.mitre.org/software/S1162","kind":"malware","description":"[Playcrypt](https://attack.mitre.org/software/S1162) encrypts files on targeted hosts with an AES-RSA hybrid encryption, encrypting every other file portion of 0x100000 bytes.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--23f12b64-a938-4cf7-97ab-81e90ee3992d","references":[{"source_name":"CISA Play Ransomware Advisory December 2023","description":"CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) uses the legitimate BitLocker application to encrypt victim files for ransom.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--78a8b5dd-0dfc-4dea-bc07-b5a3a10f0483","references":[{"source_name":"Kaspersky ShrinkLocker 2024","description":"Cristian Souza, Eduardo Ovalle, Ashley Muñoz, & Christopher Zachor. (2024, May 23). ShrinkLocker: Turning BitLocker into ransomware. Retrieved December 7, 2024.","url":"https://securelist.com/ransomware-abuses-bitlocker/112643/"},{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) is ransomware using a shared key across victims for encryption.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--0802fe34-8d63-4ac8-9143-a7a386868c47","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1181","name":"BlackByte 2.0 Ransomware","url":"https://attack.mitre.org/software/S1181","kind":"malware","description":"[BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) is a ransomware variant associated with [BlackByte](https://attack.mitre.org/groups/G1043) operations.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--53ab3350-e0d1-4376-94f1-8402c4f97cfa","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S1191","name":"Megazord","url":"https://attack.mitre.org/software/S1191","kind":"malware","description":"[Megazord](https://attack.mitre.org/software/S1191) can encrypt files on targeted Windows hosts leaving them with a  \".powerranges\" file extension.(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)","relationship_id":"relationship--ea9e76d8-7f14-445d-9d3d-835238d727f8","references":[{"source_name":"CISA Akira Ransomware APR 2024","description":"CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"},{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1194","name":"Akira _v2","url":"https://attack.mitre.org/software/S1194","kind":"malware","description":"The [Akira _v2](https://attack.mitre.org/software/S1194) encryptor targets the `/vmfs/volumes/` path by default and can use the rust-crypto 0.2.36 library crate for the encryption processes.(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)","relationship_id":"relationship--b5ae6046-3a14-4cae-8612-c9d414567e19","references":[{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"},{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can use standard AES and elliptic-curve cryptography algorithms to encrypt victim data.(Citation: Palo Alto Lockbit 2.0 JUN 2022)(Citation: SentinelOne LockBit 2.0)\n","relationship_id":"relationship--d9701e96-5901-4e81-95d8-8938bbff9566","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","description":"Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"},{"source_name":"SentinelOne LockBit 2.0","description":"SentinelOne. (n.d.). LockBit 2.0: In-Depth Analysis, Detection, Mitigation, and Removal. Retrieved January 24, 2025.","url":"https://www.sentinelone.com/anthology/lockbit-2-0/"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can encrypt targeted data using the AES-256, ChaCha20, or RSA-2048 algorithms.(Citation: Joint Cybersecurity Advisory LockBit JUN 2023)(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)(Citation: INCIBE-CERT LockBit MAR 2024)","relationship_id":"relationship--d96dafc9-c011-4f5b-a823-ff174ab7d345","references":[{"source_name":"Joint Cybersecurity Advisory LockBit JUN 2023","description":"CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"},{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"},{"source_name":"INCIBE-CERT LockBit MAR 2024","description":"INCIBE-CERT. (2024, March 14). LockBit: response and recovery actions. Retrieved February 5, 2025.","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"},{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","description":"Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) can use Elliptic Curve Encryption to encrypt files on targeted systems.(Citation: CISA RansomHub AUG 2024) [RansomHub](https://attack.mitre.org/software/S1212) can also skip content at regular intervals (ex. encrypt 1 MB, skip 3 MB) to optomize performance and enable faster encryption for large files.(Citation: Group-IB RansomHub FEB 2025) ","relationship_id":"relationship--a3e75daa-c9a5-41c5-9225-dd7b69400edc","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"},{"source_name":"CISA RansomHub AUG 2024","description":"CISA et al. (2024, August 29). #StopRansomware: RansomHub Ransomware. Retrieved March 17, 2025.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-242a-stopransomware-ransomhub-ransomware_1.pdf"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: SentinelOne Qilin NOV 2022)(Citation: Picus Qilin MAR 2025)(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Halcyon Qilin.B OCT 2024)(Citation: HC3 Qilin Threat Profile JUN 2024)(Citation: Trend Micro Agenda Ransomware OCT 2025)(Citation: Cisco Talos Qilin Ransomware OCT 2025)","relationship_id":"relationship--89b2422c-6b9a-479c-bb07-52e73967066a","references":[{"source_name":"Picus Qilin MAR 2025","description":"Hacioglu, S. (2025, March 10). Qilin Ransomware: Exposing the TTPs Behind One of the Most Active Ransomware Campaigns of 2024. Retrieved September 26, 2025.","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"},{"source_name":"Halcyon Qilin.B OCT 2024","description":"Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025.","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"HC3 Qilin Threat Profile JUN 2024","description":"Health Sector Cybersecurity Coordination Center. (2024, June 18). Qilin, aka Agenda Ransomware. Retrieved September 26, 2025.","url":"https://www.aha.org/system/files/media/file/2024/06/tlp-clear-hc3-threat-profile-qilin-aka-agenda-ransomware-6-18-2024.pdf"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"SentinelOne Qilin NOV 2022","description":"SentinelOne. (2022, November 30). Agenda (Qilin). Retrieved September 26, 2025.","url":"https://www.sentinelone.com/anthology/agenda-qilin/"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"},{"source_name":"BushidoToken Qilin RaaS JUN 2024","description":"Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025.","url":"https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"},{"source_name":"Trend Micro Agenda Ransomware OCT 2025","description":"Trend Micro. (2025, October 23). Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques. Retrieved March 26, 2026.","url":"https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has encrypted files using AES-256 encryption, which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--eb251021-d2a1-46bd-bf9e-e6066d03f298","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has the ability to encrypt files with the ChaCha20 and Curve25519 cryptographic algorithms.(Citation: Cyble Embargo Ransomware May 2024) [Embargo](https://attack.mitre.org/software/S1247) also has the ability to encrypt system data and add a random six-letter extension consisting of hexadecimal characters such as \".b58eeb\" or “.3d828a” to encrypted files.(Citation: ESET Embargo Ransomware October 2024) ","relationship_id":"relationship--eb5164e4-bd62-4b9d-bfcc-fba023b7e235","references":[{"source_name":"Cyble Embargo Ransomware May 2024","description":"Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025.","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"},{"source_name":"ESET Embargo Ransomware October 2024","description":"Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025.","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"\n[LODEINFO](https://attack.mitre.org/software/S9020) can incorporate a ransom command to encrypt specified files and folders.(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ESET MirrorFace DEC 2022)(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--18fbf9cb-5008-4701-99de-11cfa35978df","references":[{"source_name":"ESET MirrorFace DEC 2022","description":"Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Kaspersky LODEINFO Part II OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has leveraged ephemeral Curve25519 keys with XChaCha20 stream ciphers to encrypt files.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)","relationship_id":"relationship--d2ccd7a6-117e-4d10-bb86-2f9ea6cb911b","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"},{"source_name":"MSTI_GentelmenRansomware_May2026","description":"Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"}]}],"actors":[{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used [Prestige](https://attack.mitre.org/software/S1058) ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.(Citation: Microsoft Prestige ransomware October 2022)","relationship_id":"relationship--9e65e16c-eecc-4b8f-befa-01a5cf94ca8c","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022) Additionally, [FIN7](https://attack.mitre.org/groups/G0046) has deployed ransomware as the end payload during big game hunting.(Citation: BlackBerry_FIN7_April2024)  ","relationship_id":"relationship--5ed383c7-a4b7-441b-8f99-a9927689aea0","references":[{"source_name":"BlackBerry_FIN7_April2024","description":" The BlackBerry Research and Intelligence Team. (2024, April 17). Threat Group FIN7 Targets the U.S. Automotive Industry. Retrieved May 1, 2025.","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source_name":"Mandiant FIN7 Apr 2022","description":"Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022.","url":"https://www.mandiant.com/resources/evolution-of-fin7"},{"source_name":"CrowdStrike Carbon Spider August 2021","description":"Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has used BitLocker and DiskCryptor to encrypt targeted workstations. (Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)","relationship_id":"relationship--30da3c92-05b8-40fd-b8b6-29cb20a597a1","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"Microsoft Iranian Threat Actor Trends November 2021","description":"MSTIC. (2021, November 16). Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021. Retrieved January 12, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"id":"G0061","name":"FIN8","url":"https://attack.mitre.org/groups/G0061","kind":"intrusion-set","description":"[FIN8](https://attack.mitre.org/groups/G0061) has deployed ransomware such as [Ragnar Locker](https://attack.mitre.org/software/S0481), White Rabbit, and attempted to execute Noberus on compromised networks.(Citation: Symantec FIN8 Jul 2023)","relationship_id":"relationship--f36a77f2-dfab-4636-a796-67e6416031ef","references":[{"source_name":"Symantec FIN8 Jul 2023","description":"Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has used Hermes ransomware to encrypt files with AES256.(Citation: FireEye APT38 Oct 2018)","relationship_id":"relationship--02e23a00-846a-4b86-9146-4a7354c23667","references":[{"source_name":"FireEye APT38 Oct 2018","description":"FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"id":"G0092","name":"TA505","url":"https://attack.mitre.org/groups/G0092","kind":"intrusion-set","description":"[TA505](https://attack.mitre.org/groups/G0092) has used a wide variety of ransomware, such as [Clop](https://attack.mitre.org/software/S0611), Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.(Citation: Proofpoint TA505 Sep 2017)","relationship_id":"relationship--c99ee3c6-7d62-4514-bdac-4bf899ea0c16","references":[{"source_name":"Proofpoint TA505 Sep 2017","description":"Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.(Citation: FireEye APT41 Aug 2019) [APT41](https://attack.mitre.org/groups/G0096) also used Microsoft Bitlocker to encrypt workstations and Jetico’s BestCrypt to encrypt servers.(Citation: apt41_dcsocytec_dec2022)","relationship_id":"relationship--acfaf7ec-7b92-40ec-a844-17089791a663","references":[{"source_name":"apt41_dcsocytec_dec2022","description":"DCSO CyTec Blog. (2022, December 24). APT41 — The spy who failed to encrypt me. Retrieved June 13, 2024.","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) has encrypted domain-controlled systems using [BitPaymer](https://attack.mitre.org/software/S0570).(Citation: Crowdstrike Indrik November 2018) Additionally, [Indrik Spider](https://attack.mitre.org/groups/G0119) used [PsExec](https://attack.mitre.org/software/S0029) to execute a ransomware script.(Citation: Mandiant_UNC2165)","relationship_id":"relationship--a5ee5826-e742-4847-9816-d9124827262a","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"},{"source_name":"Mandiant_UNC2165","description":"Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has used [BlackCat](https://attack.mitre.org/software/S1068) and DragonForce ransomware to encrypt files including on VMWare ESXi servers.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: MSTIC Octo Tempest Operations October 2023)(Citation: CrowdStrike Scattered Spider JUL 2025)(Citation: Mandiant VMware vSphere JUL 2025)(Citation: Check Point Scattered Spider JUL 2025)","relationship_id":"relationship--47a9cbf2-d225-4cdd-ad8a-760e2c32f6cb","references":[{"source_name":"CrowdStrike Scattered Spider JUL 2025","description":" Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source_name":"Check Point Scattered Spider JUL 2025","description":"Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"},{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source_name":"Mandiant VMware vSphere JUL 2025","description":"Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source_name":"MSTIC Octo Tempest Operations October 2023","description":"Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"id":"G1024","name":"Akira","url":"https://attack.mitre.org/groups/G1024","kind":"intrusion-set","description":"[Akira](https://attack.mitre.org/groups/G1024) encrypts files in victim environments as part of ransomware operations.(Citation: BushidoToken Akira 2023)(Citation: CISA Akira Ransomware APR 2024)","relationship_id":"relationship--9ed66c72-199a-47d7-8bdd-95c34a370d33","references":[{"source_name":"CISA Akira Ransomware APR 2024","description":"CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source_name":"BushidoToken Akira 2023","description":"Will Thomas. (2023, September 15). Tracking Adversaries: Akira, another descendent of Conti. Retrieved February 21, 2024.","url":"https://blog.bushidotoken.net/2023/09/tracking-adversaries-akira-another.html"}]},{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"[INC Ransom](https://attack.mitre.org/groups/G1032) has used [INC Ransomware](https://attack.mitre.org/software/S1139) to encrypt victim's data.(Citation: SentinelOne INC Ransomware)(Citation: Huntress INC Ransom Group August 2023)(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Secureworks GOLD IONIC April 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: SOCRadar INC Ransom January 2024)","relationship_id":"relationship--05a9fa5f-7273-4c4e-846c-1b04754208c6","references":[{"source_name":"Secureworks GOLD IONIC April 2024","description":"Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.","url":"https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"},{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source_name":"SentinelOne INC Ransomware","description":"SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source_name":"SOCRadar INC Ransom January 2024","description":"SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024.","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source_name":"Huntress INC Ransom Group August 2023","description":"Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"},{"source_name":"Bleeping Computer INC Ransomware March 2024","description":"Toulas, B. (2024, March 27). INC Ransom threatens to leak 3TB of NHS Scotland stolen data. Retrieved June 5, 2024.","url":"https://www.bleepingcomputer.com/news/security/inc-ransom-threatens-to-leak-3tb-of-nhs-scotland-stolen-data/"}]},{"id":"G1036","name":"Moonstone Sleet","url":"https://attack.mitre.org/groups/G1036","kind":"intrusion-set","description":"[Moonstone Sleet](https://attack.mitre.org/groups/G1036) has deployed ransomware in victim environments.(Citation: Microsoft Moonstone Sleet 2024)","relationship_id":"relationship--f38fe70e-e940-4884-91e4-d06363f248d3","references":[{"source_name":"Microsoft Moonstone Sleet 2024","description":"Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)(Citation: Cisco BlackByte 2024)","relationship_id":"relationship--e1d5115c-126f-4fc2-b28f-6031c0d1ca70","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Cisco BlackByte 2024","description":"James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans. (2024, August 28). BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks. Retrieved December 16, 2024.","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source_name":"Symantec BlackByte 2022","description":"Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"},{"source_name":"FBI BlackByte 2022","description":"US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"id":"G1046","name":"Storm-1811","url":"https://attack.mitre.org/groups/G1046","kind":"intrusion-set","description":"[Storm-1811](https://attack.mitre.org/groups/G1046) is a financially-motivated entity linked to the deployment of [Black Basta](https://attack.mitre.org/software/S1070) ransomware in victim environments.(Citation: Microsoft Storm-1811 2024)","relationship_id":"relationship--a33939b9-83e7-435a-bfc5-1889d720b7ec","references":[{"source_name":"Microsoft Storm-1811 2024","description":"Microsoft Threat Intelligence. (2024, May 15). Threat actors misusing Quick Assist in social engineering attacks leading to ransomware. Retrieved March 14, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"id":"G1050","name":"Water Galura","url":"https://attack.mitre.org/groups/G1050","kind":"intrusion-set","description":"[Water Galura](https://attack.mitre.org/groups/G1050) has encrypted files on victim networks through the generation of [Qilin](https://attack.mitre.org/software/S1242) ransomware payloads.(Citation: BushidoToken Qilin RaaS JUN 2024)\n","relationship_id":"relationship--b9080073-c6c8-4220-894b-26153cc04f61","references":[{"source_name":"BushidoToken Qilin RaaS JUN 2024","description":"Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025.","url":"https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--973de5df-473f-4791-877d-9c8e7b5527e4","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has encrypted files in victim environments using ransomware as a service (RaaS) including Sabbath, Hive, [BlackCat](https://attack.mitre.org/software/S1068), Hunters International, [LockBit 3.0](https://attack.mitre.org/software/S1202) and [Embargo](https://attack.mitre.org/software/S1247) ransomware.(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)","relationship_id":"relationship--72afd916-54df-4524-acbd-1058b5dbe650","references":[{"source_name":"Microsoft Storm-0501 Embargo Ransomware August 2025","description":"Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)(Citation: DOJ FBI Handala Hack March 2026)","relationship_id":"relationship--17f8969b-b2a5-440f-bf7b-9214826fe5f7","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","description":"Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"},{"source_name":"DOJ FBI Handala Hack March 2026","description":"DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"id":"G1056","name":"TeamPCP","url":"https://attack.mitre.org/groups/G1056","kind":"intrusion-set","description":"[TeamPCP](https://attack.mitre.org/groups/G1056) has deployed ransomware and has announced partnerships with ransomware groups including Vect and CipherForce in online criminal forums.(Citation: Palo Alto TeamPCP MAR 2026)","relationship_id":"relationship--22409a5a-ed28-4930-a6ed-73e82f3b411b","references":[{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"G1058","name":"The Gentlemen","url":"https://attack.mitre.org/groups/G1058","kind":"intrusion-set","description":"[The Gentlemen](https://attack.mitre.org/groups/G1058) has used [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) to encrypt victim’s data.(Citation: Sophos_TheGentlemen_Sept2026)(Citation: SoučekESET_Gentlemen_Jun2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)","relationship_id":"relationship--277e1ee7-74d2-4024-8975-4611d2e87430","references":[{"source_name":"CarveyODonnellWelchHuntress_TheGentlemen_May2026","description":"Carvey, H., O'Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026.","url":"https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"},{"source_name":"TrendAI_TheGentlemen_Sept2025","description":"Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"},{"source_name":"Sophos_TheGentlemen_Sept2026","description":"Sophos Counter Threat Unit Research Team. (2026, September 1). Ungentlemanly behavior: Insights into a ransomware operation. Retrieved September 18, 2026.","url":"https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation"},{"source_name":"SoučekESET_Gentlemen_Jun2026","description":"Souček, J. (2026, June 18). Killing me gently: Inside Gentlemen’s EDR killer framework. Retrieved September 18, 2026.","url":"https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"}]}],"mitigations":[{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"On Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware.(Citation: win10_asr) In AWS environments, create an IAM policy to restrict or block the use of SSE-C on S3 buckets.(Citation: Halcyon AWS Ransomware 2025)","relationship_id":"relationship--9c8dee77-e751-40b6-ab99-ccfe6a832e0a","references":[{"source_name":"Halcyon AWS Ransomware 2025","description":"Halcyon RISE Team. (2025, January 13). Abusing AWS Native Services: Ransomware Encrypting S3 Buckets with SSE-C. Retrieved March 18, 2025.","url":"https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c"},{"source_name":"win10_asr","description":"Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}]},{"id":"M1053","name":"Data Backup","url":"https://attack.mitre.org/mitigations/M1053","kind":"course-of-action","description":"Consider implementing IT disaster recovery plans that contain procedures for regularly taking and testing data backups that can be used to restore organizational data.(Citation: Ready.gov IT DRP) Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery. Consider enabling versioning in cloud environments to maintain backup copies of storage objects.(Citation: Rhino S3 Ransomware Part 2)","relationship_id":"relationship--f8bb44c8-d368-4d56-b039-50d6419ab60a","references":[{"source_name":"Ready.gov IT DRP","description":"Ready.gov. (n.d.). IT Disaster Recovery Plan. Retrieved March 15, 2019.","url":"https://www.ready.gov/business/implementation/IT"},{"source_name":"Rhino S3 Ransomware Part 2","description":"Gietzen, S. (n.d.). S3 Ransomware Part 2: Prevention and Defense. Retrieved April 14, 2021.","url":"https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/"}]}],"candidates":[{"id":"08cbf59f-85da-4369-a5f4-049cffd7709f","name":"Encrypt files using ccrypt (FreeBSD/Linux)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"Attempts to encrypt data on target systems as root to simulate an interruption authentication to target system. If root permissions are not available then attempts to encrypt data within user's home directory.\n","inputs":{"cped_file_path":{"description":"Path where you want your copied file to be","type":"path","default":"/tmp/passwd"},"root_input_file_path":{"description":"Path the target file to be encrypted. File will be copied to /tmp/ before encrypting","type":"path","default":"/etc/passwd"},"pwd_for_encrypted_file":{"description":"Password to use for encryption","type":"string","default":"passwd"}},"dependencies":[{"description":"Finds where ccencrypt and ccdecrypt are located\n"}],"source_definition_sha256":"b372b9a094f74d7578b97fc3e0439f1bc516b39d01e32b599fa7467062cdc7da"},{"id":"142752dc-ca71-443b-9359-cf6f497315f1","name":"Encrypt files using openssl (FreeBSD/Linux)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"Uses openssl to encrypt a file\n","inputs":{"private_key_path":{"description":"path to the private key","type":"path","default":"/tmp/key.pem"},"public_key_path":{"description":"path to the public key","type":"path","default":"/tmp/pub.pem"},"encryption_bit_size":{"description":"size of the bit of encryption","type":"integer","default":2048},"encrypted_file_path":{"description":"path to the encrypted file","type":"path","default":"/tmp/passwd.zip"},"input_file_path":{"description":"path to the file that you want to encrypt","type":"path","default":"/etc/passwd"}},"dependencies":[{"description":"Finds where openssl is located\n"}],"source_definition_sha256":"20a64e3f1a1def56ada3e426c9e240ae76d096b77ba5233ba4beab37265dfa40"},{"id":"1a01f6b8-b1e8-418e-bbe3-78a6f822759e","name":"Encrypt files using openssl utility - macOS","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"This test encrypts the file(s) using the openssl utility\n","inputs":{"encryption_option":{"description":"Specifiy the required encryption option","type":"string","default":"-pbkdf2"},"input_file_path":{"description":"Path to the file that you want to encrypt","type":"path","default":"~/test.txt"},"output_file_name":{"description":"Path to the file that you want to encrypt","type":"string","default":"ARTFile"}},"dependencies":[],"source_definition_sha256":"969669f9a4d08617f678278615742621eca6005f07b46c8e984a8e7df08c6dff"},{"id":"44b68e11-9da2-4d45-a0d9-893dabd60f30","name":"Data Encrypt Using DiskCryptor","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"DiskCryptor, an open source encryption utility, can be exploited by adversaries for encrypting all disk partitions, including system partitions. This tool was identified in a ransomware campaign, as reported on https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/. The documentation for DiskCryptor can be found at https://github.com/DavidXanatos/DiskCryptor. During the installation process, running dcrypt.exe starts the encryption console. It's important to note that a system reboot is necessary as part of the installation.\n","inputs":{"dcrypt_exe":{"description":"The dcrypt.exe executable from dcrypt_setup.exe","type":"path","default":"dcrypt.exe"}},"dependencies":[{"description":"dcrypt_setup will be installed at specified location (#{dcrypt_exe})\n"}],"source_definition_sha256":"9173e8ff3d4a53336901a63e00dfadd930eef06def5ba822bc3e7212300dbdb0"},{"id":"4541e2c2-33c8-44b1-be79-9161440f1718","name":"Data Encrypted with GPG4Win","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"Gpg4win is a Windows tool (also called Kleopatra which is the preferred certificate manager) that uses email and file encryption packages for symmetric encryption. It is used by attackers to encrypt disks. User will need to add pass phrase to encrypt file as automation is not allowed under newer versions.","inputs":{"GPG_Exe_Location":{"description":"Path of the GPG program","type":"path","default":"C:\\Program Files (x86)\\GnuPG\\bin\\gpg.exe"},"File_to_Encrypt_Location":{"description":"Path of File","type":"path","default":"$env:temp\\test.txt"}},"dependencies":[{"description":"GPG must exist at (#{GPG_Exe_Location}). If -GetPrereqs fails, try to install GPG4WIN manually at 'https://www.gpg4win.org/download.html'. Once done, run -CheckPrereqs to confirm that it works.\n"}],"source_definition_sha256":"084488fc08fd4541fb160bd143526b1d588e65219b95f8aa14868ca7225f61f2"},{"id":"53e6735a-4727-44cc-b35b-237682a151ad","name":"Encrypt files using 7z (FreeBSD/Linux)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"Uses 7z to encrypt a file\n","inputs":{"pwd_for_encrypted_file":{"description":"the password that you want for the encrypted file","type":"string","default":"passwd"},"encrypted_file_path":{"description":"path to the encrypted file","type":"path","default":"/tmp/passwd.zip"},"input_file_path":{"description":"path to the file that you want to encrypt","type":"path","default":"/etc/passwd"}},"dependencies":[{"description":"Finds where 7z is located\n"}],"source_definition_sha256":"84fb9e047db2e205c516badbc6ec3c40152c4fe1053e526353b1193db6e66ddf"},{"id":"645f0f5a-ef09-48d8-b9bc-f0e24c642d72","name":"Encrypt files using 7z utility - macOS","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"This test encrypts the file(s) using the 7z utility\n","inputs":{"file_password":{"description":"Password to be provided for archiving the file","type":"string","default":"ARTPass"},"encrypted_file_name":{"description":"Name of the archive to be created","type":"string","default":"ARTArchive.7z"},"input_file_path":{"description":"Path to the file that you want to encrypt","type":"path","default":"~/test.txt"}},"dependencies":[{"description":"Check if 7z command exists on the machine\n"}],"source_definition_sha256":"0837450da0e566bfb94bc10c7bce65b68af98e0fb56748a9c0aa2efdb34f8c6e"},{"id":"649349c7-9abf-493b-a7a2-b1aa4d141528","name":"PureLocker Ransom Note","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"building the IOC (YOUR_FILES.txt) for the PureLocker ransomware \nhttps://www.bleepingcomputer.com/news/security/purelocker-ransomware-can-lock-files-on-windows-linux-and-macos/\n","inputs":{},"dependencies":[],"source_definition_sha256":"12f31e8ce66fbcab137df71d7cff53d5284f71bdc4721770ee5c05d4b58dd6ea"},{"id":"7b8ce084-3922-4618-8d22-95f996173765","name":"Encrypt files using gpg (FreeBSD/Linux)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"Uses gpg to encrypt a file\n","inputs":{"pwd_for_encrypted_file":{"description":"the password that you want for the encrypted file","type":"string","default":"passwd"},"encrypted_file_path":{"description":"path to the encrypted file","type":"path","default":"/tmp/passwd.gpg"},"input_file_path":{"description":"path to the file that you want to encrypt","type":"path","default":"/etc/passwd"},"encryption_alg":{"description":"encryption algorithm of the file","type":"string","default":"AES-256"}},"dependencies":[{"description":"Finds where gpg is located\n"}],"source_definition_sha256":"7a8afde3ada7254264d650bcb295abb1110561b0221bbcaa25216fa07d18f3f4"},{"id":"ab3f793f-2dcc-4da5-9c71-34988307263f","name":"Akira Ransomware drop Files with .akira Extension and Ransomnote","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1486/T1486.yaml","description":"Dropping 100 files with random content and .akira File Extension and the Akira Ransomnote to c:\\\n","inputs":{},"dependencies":[],"source_definition_sha256":"51b1b0273edc2efac83fdefece58b396f89ac7c4392a5e212899c6b5255526e3"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1222":"/ttp-simulation/techniques/enterprise/T1222/","T1529":"/ttp-simulation/techniques/enterprise/T1529/","T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1003":"/ttp-simulation/techniques/enterprise/T1003/","T1021.002":"/ttp-simulation/techniques/enterprise/T1021.002/","T1491.001":"/ttp-simulation/techniques/enterprise/T1491.001/","T1486":"/ttp-simulation/techniques/enterprise/T1486/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1486","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0023","collector":"illustrative-lab-collector","observation":{"resource":"lab-bucket","action":"change_policy","public_access_before":false,"public_access_after":false,"change_ticket":"LAB-42"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}