{
  "family": "democry",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Ransomware:Win32/Democry is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variants. While it may not possess the advanced network propagation or EDR evasion techniques of apex predators like Ryuk or Conti, it is still highly effective at its core objective: encrypting the victim's data and demanding payment.<br><br><b>Understanding Democry (Commodity Ransomware)</b><br>To an end-user, a Democry infection results in the immediate loss of access to their personal or business files. Documents, photos, and databases are encrypted (`T1486`), their extensions are changed, and a ransom note (usually a `.txt` or `.html` file) is dropped on the desktop demanding Bitcoin. For an incident response team, this detection indicates a failure of initial defenses (phishing filters or RDP security).<br><br><b>Execution and Encryption Mechanics</b><br>Democry variants are typically delivered via mass phishing campaigns (`T1566.001`), exploit kits, or by attackers brute-forcing exposed Remote Desktop Protocol (RDP) servers (`T1133`). Upon execution (`T1204.002`), the ransomware quickly iterates through local drives and mapped network shares (`T1083`). It utilizes standard cryptography APIs (like Microsoft CryptoAPI) to encrypt files. To ensure the victim cannot easily recover, it almost always executes a command to delete the Windows Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) (`T1490`). It communicates with its C2 server to transmit the generated encryption key.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant data loss and operational downtime. Host-based IoCs include the rapid modification of files, the presence of ransom notes in every affected directory, and the execution of `vssadmin.exe` or `wbadmin.exe`. Network IoCs may include HTTP POST requests to suspicious domains transmitting the victim's machine ID and encryption keys.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1490",
    "T1083",
    "T1566.001",
    "T1486"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Shadow Copies)",
      "tactic": "Impact"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the infected endpoint from the network to prevent the ransomware from encrypting accessible network shares.",
    "Do not reboot the machine if the encryption process is still ongoing, as encryption keys might be temporarily recoverable from RAM.",
    "Identify and secure all offline backups to ensure they have not been compromised.",
    "Wipe the infected machine and restore it from a known clean image and verified backup data."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; it funds criminal activity and there is no guarantee the attacker will provide a working decryption key.",
    "Avoid reconnecting the machine to the network until it has been completely wiped and re-imaged."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}