Fantom

Overview

Executive Summary

Infection Vector and Technical Capabilities

• The Fake Windows Update Overlay: When executed, Fantom immediately displays a full-screen overlay that perfectly mimics the legitimate "Configuring critical Windows Updates" screen (complete with a progress counter). This screen blocks access to the desktop, preventing the user from interrupting the process.
• Background Encryption: While the fake update screen is displayed, the ransomware silently scans all local drives and network shares in the background, encrypting documents, images, and databases using strong cryptography (AES-128/RSA). It typically appends the `.fantom` extension to encrypted files.
• Volume Shadow Copy Deletion: It executes commands (`vssadmin.exe`) to destroy local system backups and recovery points, ensuring the victim cannot easily restore their files.
• Ransom Note Generation: Once encryption is complete, the fake update screen disappears, and the desktop wallpaper is replaced with a ransom note instructing the victim to contact an email address for payment instructions.

Threat Assessment

Incident Response and Remediation

• Immediate Network Severance: If the fake update screen is observed, physically disconnect the endpoint from the network and power it down immediately to halt the encryption process (at the risk of corrupting files currently being written).
• Do Not Pay the Ransom: Paying the ransom is strongly discouraged and does not guarantee data recovery.
• Eradication and Restoration: The only reliable remediation strategy is a complete bare-metal wipe of the infected systems and a full restoration from secure, air-gapped backups.

Known aliases

Threat reports may refer to this family under multiple names:

• Ransom.Fantom
• Trojan-Ransom.Win32.Fantom
• Win32/Filecoder.Fantom

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1486 T1490 T1036.003

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.003: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FANTOM {
    meta:
        description = "Detects Fantom (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "fantom" ascii wide nocase
        $s2 = "ransom.fantom" ascii wide nocase
        $s3 = "trojan-ransom.win32.fantom" ascii wide nocase
        $s4 = "win32/filecoder.fantom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Fantom Activity
id: 142328cd41413858ee596976d04c04dc
status: experimental
description: Detects generic indicators of the fantom malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*fantom*"
            - "*ransom.fantom*"
            - "*trojan-ransom.win32.fantom*"
            - "*win32/filecoder.fantom*"
    condition: selection
level: medium

References & External Analysis

• Search "fantom" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Neksminer
• Medfos
• Killall
• Adbreak
• Xxycec

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/fantom.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.