Procedure examples

Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.

Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.

DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.

Akira can encrypt victim filesystems for financial extortion purposes including through the use of the ChaCha20 and ChaCha8 stream ciphers.

DarkGate can deploy follow-on ransomware payloads.

LockBit 3.0 can encrypt targeted data using the AES-256, ChaCha20, or RSA-2048 algorithms.

ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.

Netwalker can encrypt files on infected machines to extort victims.

WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.

Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.

LODEINFO can incorporate a ransom command to encrypt specified files and folders.

Royal uses a multi-threaded encryption process that can partially encrypt targeted files with the OpenSSL library and the AES256 algorithm.

Embargo has the ability to encrypt files with the ChaCha20 and Curve25519 cryptographic algorithms. Embargo also has the ability to encrypt system data and add a random six-letter extension consisting of hexadecimal characters such as ".b58eeb" or “.3d828a” to encrypted files.

Shamoon has an operational mode for encrypting data instead of overwriting it.

Black Basta can encrypt files with the ChaCha20 cypher and using a multithreaded process to increase speed. Black Basta has also encrypted files while the victim system is in safe mode, appending `.basta` upon completion.

MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.

The Akira _v2 encryptor targets the `/vmfs/volumes/` path by default and can use the rust-crypto 0.2.36 library crate for the encryption processes.

BlackByte Ransomware is ransomware using a shared key across victims for encryption.

Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.

Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.

LockBit 2.0 can use standard AES and elliptic-curve cryptography algorithms to encrypt victim data.

JCry has encrypted files and demanded Bitcoin to decrypt those files.

REvil can encrypt files on victim systems and demands a ransom to decrypt the files.

ROADSWEEP can RC4 encrypt content in blocks on targeted systems.

Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.

Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.

Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.

XCSSET performs AES-CBC encryption on files under ~/Documents, ~/Downloads, and
~/Desktop with a fixed key and renames files to give them a .enc extension. Only files with sizes
less than 500MB are encrypted.

KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.

Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.

INC Ransomware can encrypt data on victim systems, including through the use of partial encryption and multi-threading to speed encryption.

FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.

Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.

BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.

TeamPCP has deployed ransomware and has announced partnerships with ransomware groups including Vect and CipherForce in online criminal forums.

Indrik Spider has used PsExec to stop services prior to the execution of ransomware.

Kimsuky has disabled actively running virtual environments using the `KillMe` function to include VMware, Microsoft Hypervisors, and VirtualBox.

Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.

Medusa Group has terminated services related to backups, security, databases, communication, filesharing and websites.

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.

LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.

Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.

EKANS stops database, data backup solution, antivirus, and ICS-related processes.

BRICKSTORM has terminated an existing process to ensure that its own new process can execute.

AvosLocker has terminated specific processes before encryption.

RobbinHood stops 181 Windows services on the system before beginning the encryption process.

RansomHub has the ability to terminate specified services.

Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using `C:\Windows\System32\net.exe stop MSSQLSERVER`.

InvisibleFerret has terminated Chrome and Brave browsers using the `taskkill` command on Windows and the `killall` command on other systems such as Linux and macOS. InvisibleFerret has also utilized it’s `ssh_kill` command to terminate Chrome and Brave browser processes.

Hannotog can stop Windows services.