{
  "family": "samsam",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Ransom:Win32/SamSam (also known as Samas) is a highly destructive, **Targeted Ransomware** family that gained infamy for crippling hospitals, municipalities, and large enterprises (most notably the City of Atlanta in 2018). Unlike traditional 'spray-and-pray' ransomware spread via mass phishing, SamSam is characterized by its *manual deployment*. Attackers breach the network, map the infrastructure, and deliberately execute the encryptor for maximum extortion impact.<br><br><b>Understanding SamSam (Targeted Ransomware)</b><br>To an end-user, the impact is catastrophic: servers and workstations are suddenly encrypted, appended with the `.weapologize` extension (or similar), and a ransom note (`PLEASE_READ_FOR_DECRYPT.txt`) demands massive cryptocurrency payments. For an incident response team, a SamSam infection means a human adversary has been actively roaming the network for days or weeks, escalating privileges and intentionally disabling backups before launching the final payload.<br><br><b>Execution and Manual Deployment Mechanics</b><br>The initial attack vector is almost never an email. Attackers typically exploit vulnerable, public-facing infrastructure, most commonly brute-forcing or exploiting unpatched Remote Desktop Protocol (RDP) servers or vulnerable JBoss application servers (`T1190`, `T1133`). Once inside, they use legitimate tools (like Mimikatz and PsExec) to harvest domain admin credentials (`T1003.001`) and move laterally (`T1569.002`). The attackers then manually copy the SamSam encryptor binary to critical servers and workstations. They often use batch scripts to systematically delete Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) and then manually execute the SamSam payload using an RSA-2048/AES-256 hybrid encryption scheme (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total operational paralysis and severe financial loss. Host-based IoCs include the presence of the SamSam executable (often named `sysname.exe` or `svchost.exe` running from odd locations), the execution of `vssadmin` or `bcdedit` commands just prior to encryption, and the specific `.weapologize` or `.samsam` file extensions. Network IoCs include a massive spike in internal RDP traffic and SMB file transfers (PsExec) leading up to the event, as the attacker manually distributes the payload.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1133",
    "T1486",
    "T1490",
    "T1569.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1133",
      "name": "External Remote Services (Initial access via RDP)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1569.002",
      "name": "System Services: Service Execution (Lateral movement via PsExec)",
      "tactic": "Execution"
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Shadow Copies)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "IMMEDIATELY isolate all affected subnets and shut down any exposed RDP gateways to prevent further lateral movement by the active human adversary.",
    "Do not assume the attack is over once encryption starts; the attackers may still have persistence via backdoors or compromised domain admin accounts.",
    "Identify the initial entry point (e.g., exposed RDP on a specific server) and patch/secure it before attempting restoration.",
    "Restore systems from offline, immutable backups; SamSam attackers deliberately target and encrypt connected backup servers."
  ],
  "what_to_avoid": [
    "Do not treat a SamSam infection as an automated virus event; you must hunt for the active attacker's persistence mechanisms and compromised accounts.",
    "Avoid paying the ransom; SamSam operators have occasionally failed to provide working decryptors even after payment."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}