Procedure examples

During SharePoint ToolShell Exploitation, threat actors deployed ransomware including 4L4MD4R and Warlock.

During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.

During C0015, the threat actors used Conti ransomware to encrypt a compromised network.

During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.

APT38 has used Hermes ransomware to encrypt files with AES256.

Indrik Spider has encrypted domain-controlled systems using BitPaymer. Additionally, Indrik Spider used PsExec to execute a ransomware script.

BlackByte has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.

APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user. APT41 also used Microsoft Bitlocker to encrypt workstations and Jetico’s BestCrypt to encrypt servers.

Storm-1811 is a financially-motivated entity linked to the deployment of Black Basta ransomware in victim environments.

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware. Additionally, FIN7 has deployed ransomware as the end payload during big game hunting.

Sandworm Team has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.

Scattered Spider has used BlackCat and DragonForce ransomware to encrypt files including on VMWare ESXi servers.

Akira encrypts files in victim environments as part of ransomware operations.

Storm-0501 has encrypted files in victim environments using ransomware as a service (RaaS) including Sabbath, Hive, BlackCat, Hunters International, LockBit 3.0 and Embargo ransomware.

TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.

Medusa Group has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”

Water Galura has encrypted files on victim networks through the generation of Qilin ransomware payloads.

INC Ransom has used INC Ransomware to encrypt victim's data.

Moonstone Sleet has deployed ransomware in victim environments.

VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.

Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations.

FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.

EKANS uses standard encryption library functions to encrypt files.

SynAck encrypts the victims machine followed by asking the victim to pay a ransom.

AvosLocker has encrypted files and network resources using AES-256 and added an `.avos`, `.avos2`, or `.AvosLinux` extension to filenames.

RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.

RansomHub can use Elliptic Curve Encryption to encrypt files on targeted systems. RansomHub can also skip content at regular intervals (ex. encrypt 1 MB, skip 3 MB) to optomize performance and enable faster encryption for large files.

Prestige has leveraged the CryptoPP C++ library to encrypt files on target systems using AES and appended filenames with `.enc`.

Playcrypt encrypts files on targeted hosts with an AES-RSA hybrid encryption, encrypting every other file portion of 0x100000 bytes.

Medusa Ransomware has encrypted files using AES-256 encryption, which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”

Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.

ShrinkLocker uses the legitimate BitLocker application to encrypt victim files for ransom.

BlackByte 2.0 Ransomware is a ransomware variant associated with BlackByte operations.

WastedLocker can encrypt data and leave a ransom note.

ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.

Moneybird targets a common set of file types such as documents, certificates, and database files for encryption while avoiding executable, dynamic linked libraries, and similar items.

Apostle creates new, encrypted versions of files then deletes the originals, with the new filenames consisting of a random GUID and ".lock" for an extension.

SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.

Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.

Megazord can encrypt files on targeted Windows hosts leaving them with a ".powerranges" file extension.

Diavol has encrypted files using an RSA key though the `CryptEncrypt` API and has appended filenames with ".lock64".

BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances.

Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.

DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.

NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.

Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.

LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.

HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.

Cheerscrypt can encrypt data on victim machines using a Sosemanuk stream cipher with an Elliptic-curve Diffie–Hellman (ECDH) generated key.

Babuk can use ChaCha8 and ECDH to encrypt data.