{
  "family": "matrix",
  "sample_count": 22,
  "category": "ransomware",
  "description": "Ransomware:Win32/Matrix is a highly destructive and targeted ransomware family. Unlike spray-and-pray ransomware distributed via malspam, Matrix operators are known for 'Big Game Hunting', actively penetrating corporate networks, moving laterally, and manually deploying the ransomware to maximize damage and extort massive payouts.<br><br><b>Understanding Matrix</b><br>To the victim organization, a Matrix infection is a catastrophic event. Critical servers and workstations are rapidly encrypted, with filenames appended with highly randomized extensions (often including a contact email address, e.g., `.CHKL`) and a ransom note left in every directory. For incident responders, Matrix represents a failure in network perimeter security. The attackers almost exclusively gain initial access by exploiting weakly secured, internet-facing Remote Desktop Protocol (RDP) servers.<br><br><b>Execution, Lateral Movement, and Encryption</b><br>The primary initial access vector is brute-forcing or exploiting RDP (TCP 3389) (`T1133`). Once inside, the attackers manually establish persistence, often dropping Mimikatz to dump Domain Admin credentials (`T1003.001`). They use legitimate administrative tools (like PsExec or WMI) to move laterally across the network (`T1021.002`). Before executing the ransomware, they manually disable corporate antivirus and EDR solutions using elevated privileges (`T1562.001`). Matrix then uses `vssadmin.exe` to delete volume shadow copies (`T1490`) and initiates a fast, multi-threaded AES encryption routine (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total halt of business operations. EDR platforms must alert on the rapid execution of `vssadmin` or the use of PsExec initiating unknown binaries across multiple hosts simultaneously. Network logs will show massive, sustained RDP brute-force attempts leading up to the infection. The presence of encrypted files with specific, contact-email-based extensions is the definitive IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1490",
    "T1133",
    "T1110.001",
    "T1021.002",
    "T1486"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1133",
      "name": "External Remote Services",
      "tactic": "Initial Access"
    },
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing",
      "tactic": "Credential Access"
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoints and servers from the network by pulling the physical cables; the attacker likely has active, interactive RDP access.",
    "Do not reboot the servers if they are actively encrypting; rebooting can destroy cryptographic material in RAM.",
    "Audit firewall rules immediately to identify and close all Internet-facing RDP ports to prevent reinfection.",
    "Initiate a full active directory password reset, as the attackers likely dumped credentials during their lateral movement phase."
  ],
  "what_to_avoid": [
    "Do not pay the ransom. Paying funds the criminal enterprise and there is no guarantee the threat actors will provide a working decryptor.",
    "Avoid restoring from backups onto the same servers without first completely wiping them and securing the RDP access vector."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}