{
  "family": "crypren",
  "sample_count": 12,
  "category": "ransomware",
  "description": "Ransomware:Win32/Crypren is a destructive ransomware variant designed to infiltrate enterprise networks, encrypt critical user data and business databases, and extort the victim organization for a cryptocurrency ransom in exchange for the decryption key.<br><br><b>Understanding Crypren</b><br>To a victim, a Crypren infection is immediately devastating. Suddenly, documents, spreadsheets, and databases become inaccessible, their filenames often appended with a specific extension (e.g., `.crypren`). A ransom note (usually a `.txt` or `.html` file) is dropped on the desktop and in every encrypted directory, demanding payment in Bitcoin and providing contact instructions. For security analysts, Crypren represents a severe, high-priority incident requiring immediate containment to prevent lateral movement across the network.<br><br><b>Execution and Encryption Mechanics</b><br>Crypren is typically deployed by human operators after they have gained initial access via compromised RDP credentials (`T1133`), phishing (`T1566`), or exploiting unpatched edge devices. Once inside, they escalate privileges and use tools like PsExec or WMI to distribute the ransomware payload across the domain (`T1570`). Upon execution on an endpoint, Crypren uses strong cryptography (usually a combination of AES and RSA) to encrypt files (`T1486`). To ensure the victim cannot easily recover, it executes commands to delete Windows Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) and disable automatic repairs (`bcdedit`) (`T1490`). It targets local drives, mapped network drives, and unmapped network shares.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive business disruption and data loss. Incident responders will observe a sudden spike in CPU and disk I/O as the encryption routine runs. EDR alerts will frequently flag the execution of `vssadmin.exe` or `wbadmin.exe` attempting to delete backups. The presence of the newly appended file extensions and the ransom notes are definitive indicators. Network logs may show the malware attempting to contact a C2 server to transmit the unique encryption keys before the encryption process finishes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1491",
    "T1570",
    "T1133"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Shadow Copies)",
      "tactic": "Impact"
    },
    {
      "id": "T1491",
      "name": "Defacement (Ransom Note)",
      "tactic": "Impact"
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer (Deploying across the network)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1133",
      "name": "External Remote Services (RDP Compromise)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint (and any potentially infected segments) from the corporate network and the internet to prevent the ransomware from encrypting network file shares.",
    "Use EDR to kill the active encryption processes before attempting to analyze the system.",
    "Identify the initial entry vector (e.g., exposed RDP port) and close it immediately to prevent re-infection.",
    "Restore systems from clean, offline, immutable backups after performing a complete bare-metal wipe of the infected machines."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; payment does not guarantee the attackers will provide a working decryptor, and it funds future criminal operations.",
    "Avoid rebooting the machine during active encryption, as this can corrupt files currently being processed and make recovery impossible."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}