{
  "family": "crytex",
  "sample_count": 52,
  "category": "ransomware",
  "description": "Ransomware:Win32/Crytex is a destructive file-encrypting trojan (Ransomware) designed to lock user files using strong cryptography and extort cryptocurrency for the decryption key. It often targets enterprise environments, aiming to cripple critical business operations.<br><br><b>Understanding Crytex Ransomware</b><br>To the victim, a Crytex infection is an immediate crisis. Their desktop wallpaper is changed, files become inaccessible, and a ransom note appears in every affected folder. For incident responders, Crytex is a severe threat. Depending on the specific variant, it may be deployed manually by an attacker who has already breached the network (e.g., via RDP), or it may spread autonomously if it possesses worm-like capabilities.<br><br><b>Execution and Evasion Strategies</b><br>Crytex is primarily delivered via phishing emails, exploit kits, or compromised RDP credentials. Upon execution, the payload deletes Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy recovery (`T1490`). It then iterates through all local drives and accessible network shares, encrypting documents, databases, and media files. It utilizes robust encryption algorithms (like AES or RSA) ensuring files cannot be decrypted without the attacker's private key. Crytex often attempts to terminate running database services or backup software (`T1489`) to ensure those files are unlocked and available for encryption.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, catastrophic data loss and severe business interruption. EDR platforms will trigger heavily on the rapid, high-volume file modification events (`T1486`) and the execution of `vssadmin.exe` or `wbadmin.exe`. Network logs may show HTTP POST requests to the attacker's C2 infrastructure immediately preceding the encryption phase, often transmitting the unique victim ID. The presence of specific file extensions (unique to the Crytex variant) and the ransom notes are definitive IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1489",
    "T1490",
    "T1059.003",
    "T1486",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint from the network to halt the encryption process, specifically protecting mapped network shares and cloud syncing folders.",
    "Do NOT reboot or power off the machine immediately; capture a live memory image. The encryption keys may still reside in RAM.",
    "Identify the initial infection vector (likely a phishing email or open RDP) and close the vulnerability to prevent reinfection.",
    "Restore affected systems from offline, immutable backups that were not accessible to the network during the encryption phase."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; there is no guarantee the attackers will provide a working decryptor, and paying funds criminal enterprises.",
    "Avoid reconnecting the machine to the network until it has been completely wiped and rebuilt from a known-clean image."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}