Data Encrypted for Impact

APT38 has used Hermes ransomware to encrypt files with AES256.^[6]

APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.^[7]

Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.^[8]

Babuk can use ChaCha8 and ECDH to encrypt data.^{[9][10][11][12]}

Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.^[13]

BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.^[14]

Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.^[15][16][17]

Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use "Windows Restart Manager" to ensure files are unlocked and open for encryption.^{[18][19][20][21]}

Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.^[22]

DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.^[23]

Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.^[24][25]

EKANS uses standard encryption library functions to encrypt files.^[26][27]

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.^[28]

FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.^[23][29][30]

HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.^[23]

Indrik Spider has encrypted domain-controlled systems using BitPaymer.^[14]

JCry has encrypted files and demanded Bitcoin to decrypt those files. ^[31]

KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.^[32]

LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.^[33][34][35]

Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.^[36]

MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.^[37][38]

Netwalker can encrypt files on infected machines to extort victims.^[39]

NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.^[40][3][41]

Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.^[42][43]

ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.^[44]

Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.^[45]

Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.^[46][47]

REvil can encrypt files on victim systems and demands a ransom to decrypt the files.^{[48][49][50][51][52][53][54][55]}

RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.^[56]

Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.^[57][21]

SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.^[58]

Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.^[12]

Shamoon has an operational mode for encrypting data instead of overwriting it.^[59][60]

SynAck encrypts the victims machine followed by asking the victim to pay a ransom. ^[61]

TA505 has used a wide variety of ransomware, such as Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.^[62]

ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.^[63]

WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.^[64][2][65]

WastedLocker can encrypt data and leave a ransom note.^[66][67][68]

Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.^[69]

XCSSET performs AES-CBC encryption on files under ~/Documents, ~/Downloads, and~/Desktop with a fixed key and renames files to give them a .enc extension. Only files with sizes less than 500MB are encrypted.^[70]

On Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware. ^[71]

Consider implementing IT disaster recovery plans that contain procedures for regularly taking and testing data backups that can be used to restore organizational data.^[72] Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery. Consider enabling versioning in cloud environments to maintain backup copies of storage objects.^[73]