{
  "family": "amnesia",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nAmnesia refers to two distinct but significant malware threats: a destructive Ransomware variant targeting Windows systems, and a more recent IoT (Internet of Things) Botnet targeting embedded Linux devices. Both iterations are designed for extortion or severe disruption, leveraging compromised systems for financial gain or to launch massive Distributed Denial of Service (DDoS) attacks.\n\n<h3>Infection Vector and Technical Capabilities</h3>\n<strong>Amnesia Ransomware (Windows):</strong>\nTypically distributed via malicious email attachments or RDP brute-forcing. Once executed, it rapidly encrypts user files using strong encryption algorithms (e.g., AES + RSA), appending specific extensions (like `.amnesia`) to the encrypted files, and demands payment in cryptocurrency for the decryption key.\n\n<strong>Amnesia IoT Botnet (Linux/Embedded):</strong>\nThis variant propagates by scanning the internet for exposed IoT devices (like DVRs, IP cameras, or routers) and exploiting known remote code execution (RCE) vulnerabilities (such as the TVT DVR RCE exploit). \n<ul>\n<li><strong>Virtual Machine Evasion:</strong> A defining characteristic of the IoT variant is its aggressive anti-analysis capabilities. It actively attempts to detect if it is running in a virtual machine (like QEMU) used by security researchers. If detected, it attempts to permanently brick the virtual machine by deleting all files in the file system.</li>\n<li><strong>DDoS Capabilities:</strong> Once successfully installed on an IoT device, the bot connects to a C2 server and awaits commands to participate in massive, volumetric DDoS attacks against target networks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe ransomware variant poses a direct threat to business continuity, potentially causing irreversible data loss and significant financial impact. The IoT variant poses a broader threat to network stability, as compromised internal devices can be weaponized to participate in external attacks, leading to IP blacklisting and bandwidth exhaustion.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>For Windows Ransomware:</strong> Immediately isolate the infected host to prevent the ransomware from encrypting mapped network drives. Do not pay the ransom. Restore systems from offline, immutable backups.</li>\n<li><strong>For IoT Botnet:</strong> Identify the compromised embedded devices on the network. Isolate them from the internet immediately. The most effective remediation is a factory reset of the device, followed immediately by applying the latest firmware patch from the manufacturer and changing all default credentials.</li>\n<li><strong>Network Hardening:</strong> Ensure IoT devices are placed on a segregated VLAN with no direct inbound internet access to prevent exploitation.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransomware.Amnesia",
    "Linux.Amnesia",
    "Botnet.Amnesia",
    "Troj/Amnesia"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1498",
    "T1497.001",
    "T1190"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:20:09Z",
  "type": "Ransomware / IoT Botnet",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}