{
  "family": "fraudkrypt",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Ransomware:Win32/Fraudkrypt is a malicious hybrid that blends the extortion tactics of Scareware with the destructive capability of Ransomware. Its primary objective is to frighten the user into paying a fee by locking the screen or encrypting a subset of files (`T1486`), often using a heavily customized, deceptive GUI that mimics law enforcement agencies or fake antivirus alerts (`T1491.002`).<br><br><b>Understanding Fraudkrypt (Scareware/Ransomware)</b><br>To an end-user, Fraudkrypt is terrifying. They are presented with a full-screen, uncloseable window claiming they have committed a crime or their computer is hopelessly corrupted, demanding immediate payment (often via pre-paid cards or Bitcoin) to 'unlock' the system. For an IT department, Fraudkrypt variants vary wildly in severity; some merely lock the screen (easily bypassed), while others actively encrypt data.<br><br><b>Execution and Extortion Mechanics</b><br>Fraudkrypt is typically delivered via exploit kits, malicious downloads, or spam. Upon execution, it immediately alters the Windows Registry (e.g., changing the `Shell` or `Userinit` keys in `Winlogon`) (`T1547.004`) to ensure its lock-screen launches immediately upon boot, before the user can access the desktop. It then either encrypts files or simply hides them (`T1564.001`), replacing the wallpaper with its extortion demand. It disables Task Manager and Registry Editor to prevent the user from terminating the process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from severe user distress and downtime to actual data loss if encryption is used. Host-based IoCs include the highly visible, often poorly translated extortion screen, unauthorized modifications to `Winlogon` registry keys, and the presence of suspicious executables in `%AppData%` or `%Startup%`. Network IoCs include connections to payment processing portals or C2 servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.004",
    "T1486",
    "T1491.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (If the variant actually encrypts files)",
      "tactic": "Impact"
    },
    {
      "id": "T1491.002",
      "name": "Defacement: Internal Defacement (Displaying the fake law enforcement or scareware screen)",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL (Hijacking the boot process to display the lock screen)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Attempt to boot the system into Safe Mode with Command Prompt; this often bypasses the Winlogon hooks Fraudkrypt uses to lock the screen.",
    "If it's merely a screenlocker (Scareware), use `regedit` in Safe Mode to restore the `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell` key back to `explorer.exe`.",
    "If data is encrypted, check 'No More Ransom' to see if a free decryptor exists for the specific Fraudkrypt variant.",
    "Run a full offline scan using a bootable AV rescue disk to remove the underlying malware executable."
  ],
  "what_to_avoid": [
    "Under no circumstances should you pay the fine or ransom; it funds criminal operations and there is no guarantee the system will be unlocked.",
    "Avoid reinstalling the OS immediately if data is encrypted; you may be able to recover the files if a decryptor becomes available later."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}