Data Encrypted for Impact

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.[1][2][3][4] In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.[3]

To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, Credential Dumping, and Windows Admin Shares.[2][3]

ID: T1486

Tactic: Impact

Platform:  Linux, macOS, Windows

Permissions Required:  User, Administrator, root, SYSTEM

Data Sources:  Kernel drivers, File monitoring, Process command-line parameters, Process monitoring

Impact Type:  Availability

Version: 1.0



APT38 has used Hermes ransomware to encrypt files with AES256.[5]


LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.[6][7]


NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.[8][3]


SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.[9]


Shamoon has an operational mode for encrypting data instead of overwriting it.[10][11]


WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.[12][2][13]


Consider implementing IT disaster recovery plans that contain procedures for regularly taking and testing data backups that can be used to restore organizational data.[14]

In some cases, the means to decrypt files affected by a ransomware campaign is released to the public. Research trusted sources for public releases of decryptor tools/keys to reverse the effects of ransomware.

Identify potentially malicious software and audit and/or block it by using whitelisting[15] tools, like AppLocker,[16][17] or Software Restriction Policies[18] where appropriate.[19]


Use process monitoring to monitor the execution and command line parameters of of binaries involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit. Monitor for the creation of suspicious files as well as unusual file modification activity. In particular, look for large quantities of file modifications in user directories.

In some cases, monitoring for unusual kernel driver installation activity can aid in detection.