{
  "family": "cryptos",
  "sample_count": 10,
  "category": "ransomware",
  "description": "Ransomware:Win32/Cryptos is a generic heuristic detection used by antivirus engines to identify early, varied, or obfuscated forms of encryption-based ransomware. While it may not pinpoint a specific famous family (like LockBit or Ryuk), a Cryptos alert signifies a critical event: an executable is actively attempting to utilize cryptographic APIs to mass-encrypt the user's files and extort a ransom payment for the decryption key.<br><br><b>Understanding Cryptos Heuristics</b><br>To a victim, a Cryptos infection is a catastrophic event. Files suddenly change extensions (e.g., `.locked`, `.crypt`), become inaccessible, and a ransom note (usually a `.txt` or `.html` file) appears on the desktop demanding cryptocurrency. For a security analyst, this alert means perimeter defenses failed, the payload executed, and the race to stop the encryption process is on. Generic heuristics trigger on the *behavior* of rapid file modification combined with the use of Windows CryptoAPI.<br><br><b>Execution and Encryption Mechanics</b><br>Ransomware flagged as Cryptos is typically delivered via phishing emails (`T1566.001`), exploit kits, or deployed manually by attackers after moving laterally. Upon execution (`T1204.002`), it establishes persistence (often via Registry Run keys) and attempts to disable volume shadow copies and backups (`vssadmin.exe delete shadows`) (`T1490`). It then iterates through all local drives and mapped network shares, targeting specific file extensions (documents, databases, pictures) (`T1083`). It utilizes strong encryption (like AES or RSA) (`T1486`) to lock the files, overwriting the originals or creating encrypted copies and deleting the originals.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total data loss and massive business disruption. The primary IoC is an overwhelming surge in file modification events (writes/renames) across the disk. EDR logs will flag the execution of `vssadmin.exe` or `bcdedit.exe` to inhibit system recovery. Network logs may show the malware reaching out to a C2 server to transmit the unique encryption key before the ransom note is displayed.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1083",
    "T1204.002",
    "T1486",
    "T1490"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Shadow Copies)",
      "tactic": "Impact"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery (Scanning for target files)",
      "tactic": "Discovery"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the infected endpoint from the corporate network and physically unplug the network cable to prevent the ransomware from encrypting shared network drives.",
    "Do NOT turn off or reboot the machine immediately; capture a live memory dump (RAM) first, as poorly written ransomware sometimes leaves the encryption keys in memory.",
    "Identify the specific ransomware family using the ransom note or file extensions (e.g., via ID Ransomware) to see if a free decryptor exists.",
    "Initiate the enterprise Disaster Recovery (DR) plan; completely wipe the infected machine and restore data from a clean, offline backup."
  ],
  "what_to_avoid": [
    "Do NOT pay the ransom; it funds cybercrime, and there is no guarantee the attackers will provide a working decryption tool.",
    "Avoid connecting external hard drives or USBs to the infected machine to 'save' files; the ransomware will instantly encrypt the external drive as well."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}