Data Encrypted for Impact

Akira encrypts victim filesystems for financial extortion purposes.^[8]

Akira encrypts files in victim environments as part of ransomware operations.^[9]

Apostle creates new, encrypted versions of files then deletes the originals, with the new filenames consisting of a random GUID and ".lock" for an extension.^[10]

APT38 has used Hermes ransomware to encrypt files with AES256.^[11]

APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.^[12] APT41 also used Microsoft Bitlocker to encrypt workstations and Jetico’s BestCrypt to encrypt servers.^[13]

Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.^[14]

AvosLocker has encrypted files and network resources using AES-256 and added an .avos, .avos2, or .AvosLinux extension to filenames.^{[15][16][17][18]}

Babuk can use ChaCha8 and ECDH to encrypt data.^{[19][20][21][22]}

Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.^[23]

BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.^[24]

Black Basta can encrypt files with the ChaCha20 cypher and using a multithreaded process to increase speed.^{[25][26][27][28][29][30][31][32][33]}

BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances.^[34]

During C0015, the threat actors used Conti ransomware to encrypt a compromised network.^[35]

During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.^[17][36]

Cheerscrypt can encrypt data on victim machines using a Sosemanuk stream cipher with an Elliptic-curve Diffie–Hellman (ECDH) generated key.^[37][38]

Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.^[39][40][41]

Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use "Windows Restart Manager" to ensure files are unlocked and open for encryption.^{[42][5][43][44][35]}

Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.^[45]

DarkGate can deploy follow-on ransomware payloads.^[46]

DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.^[47]

DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.^[48]

Diavol has encrypted files using an RSA key though the CryptEncrypt API and has appended filenames with ".lock64". ^[49]

Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.^[6][50]

EKANS uses standard encryption library functions to encrypt files.^[51][52]

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.^[53][54]

FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.^[55]

FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.^[48][56][57]

HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.^[48]

During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.^[58][59][60]

INC Ransom has used INC Ransomware to encrypt victim's data.^{[61][62][63][64][65][66]}

INC Ransomware can encrypt data on victim systems, including through the use of partial encryption and multi-threading to speed encryption.^{[61][62][65][66][61]}

Indrik Spider has encrypted domain-controlled systems using BitPaymer.^[24] Additionally, Indrik Spider used PsExec to execute a ransomware script.^[67]

JCry has encrypted files and demanded Bitcoin to decrypt those files. ^[68]

KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.^[69]

LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.^[70][71][72]

Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations. ^[73][74]

Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.^[75]

MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.^[76][77]

Moneybird targets a common set of file types such as documents, certificates, and database files for encryption while avoiding executable, dynamic linked libraries, and similar items.^[78]

Moonstone Sleet has deployed ransomware in victim environments.^[79]

Netwalker can encrypt files on infected machines to extort victims.^[80]

NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.^[81][3][82]

Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.^[83][84]

Playcrypt encrypts files on targeted hosts with an AES-RSA hybrid encryption, encrypting every other file portion of 0x100000 bytes.^[85][86]

Prestige has leveraged the CryptoPP C++ library to encrypt files on target systems using AES and appended filenames with .enc.^[87]

ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.^[88]

Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.^[89]

Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.^[90][91]

REvil can encrypt files on victim systems and demands a ransom to decrypt the files.^{[92][93][94][95][96][97][98][99]}

ROADSWEEP can RC4 encrypt content in blocks on targeted systems.^[58][59][60]

RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.^[100]

Royal uses a multi-threaded encryption process that can partially encrypt targeted files with the OpenSSL library and the AES256 algorithm.^{[101][102][103]}

Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.^[104][44]

SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.^[105]

Sandworm Team has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.^[87]

Scattered Spider has used BlackCat ransomware to encrypt files on VMWare ESXi servers.^[106][107]

Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.^[22]

Shamoon has an operational mode for encrypting data instead of overwriting it.^[108][109]

SynAck encrypts the victims machine followed by asking the victim to pay a ransom. ^[110]

TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.^[111]

ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.^[112]

WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.^{[113][2][114]}

WastedLocker can encrypt data and leave a ransom note.^{[115][116][117]}

Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.^[118]

XCSSET performs AES-CBC encryption on files under ~/Documents, ~/Downloads, and~/Desktop with a fixed key and renames files to give them a .enc extension. Only files with sizes less than 500MB are encrypted.^[119]

On Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware. ^[120]

Consider implementing IT disaster recovery plans that contain procedures for regularly taking and testing data backups that can be used to restore organizational data.^[121] Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery. Consider enabling versioning in cloud environments to maintain backup copies of storage objects.^[122]