{
  "family": "crypton",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Ransom:Win32/Crypton is a destructive ransomware family that encrypts a victim's files and demands a cryptocurrency payment for the decryption key (`T1486`). Like many ransomware variants, it is designed to cause maximum operational disruption to extort money. It has seen various iterations, often altering the file extensions of encrypted files (e.g., appending `.crypton`, `.nemesis`, or `.xnt`).<br><br><b>Understanding Crypton (Ransomware)</b><br>To an end-user, the impact is catastrophic: personal and business files become inaccessible, their desktop wallpaper is often changed to a threatening message, and a text file containing ransom instructions is dropped on the desktop. For a SOC analyst, Crypton represents a total failure of preventative controls and initiates a major incident response effort focusing on containment and recovery.<br><br><b>Execution and Extortion Mechanics</b><br>Crypton typically gains initial access via exposed Remote Desktop Protocol (RDP) services (`T1133`), spam emails containing malicious attachments (`T1566.001`), or exploit kits. Once executed, it profiles the system, kills processes associated with database software (to unlock the files for encryption), and uses strong cryptographic algorithms (often a mix of RSA and AES) to lock user data (`T1486`). Crucially, to prevent easy recovery, Crypton executes commands (like `vssadmin.exe Delete Shadows /All /Quiet`) to destroy Windows Volume Shadow Copies (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of data availability. Host-based IoCs include files appended with the `.crypton` extension, the presence of ransom notes (often named `HOW_TO_DECRYPT_FILES.txt`), and EDR alerts for the execution of `vssadmin.exe` or `wbadmin.exe` with commands to delete backups. Network IoCs may include outbound connections to Tor-based C2 infrastructure for key negotiation, or anomalous inbound RDP traffic prior to the encryption event.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1133",
    "T1490",
    "T1486"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (The core ransomware functionality)",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Volume Shadow Copies)",
      "tactic": "Impact"
    },
    {
      "id": "T1133",
      "name": "External Remote Services (A common initial access vector for this family)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the infected endpoint IMMEDIATELY by physically disconnecting the network cable to prevent the ransomware from encrypting mapped network drives and SMB shares.",
    "Identify the initial access vector; if RDP was used, immediately disable external RDP access and force a password reset for compromised accounts.",
    "Do not reboot the machine if it is actively encrypting, as this may destroy the encryption key residing in memory; capture a RAM dump if possible.",
    "Restore the encrypted data from secure, offline backups that the ransomware could not reach."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; it funds criminal enterprises and there is no guarantee the attackers will provide a working decryptor.",
    "Avoid restoring the system while the machine is still connected to the network, as it may immediately be reinfected."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}