{
  "family": "lucky",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nLucky is a destructive Ransomware family, closely related to (and often considered a variant or evolution of) the notorious Satan ransomware. First identified around 2018, Lucky targets both Windows and Linux environments, aggressively encrypting user files, databases, and network shares to extort cryptocurrency. It is unique for its extensive use of network exploitation tools to move laterally and rapidly spread across an enterprise environment before initiating the encryption routine.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLucky is rarely distributed via broad phishing campaigns. Instead, it is deployed by attackers who have already breached the network (often via compromised RDP credentials or exploiting unpatched edge vulnerabilities like Tomcat or WebLogic servers).\n\nOnce inside, Lucky's execution is methodical and highly destructive:\n<ul>\n<li><strong>Lateral Movement (Worm Capabilities):</strong> Unlike standard ransomware, Lucky actively scans the local network for vulnerable systems. It utilizes a bundled suite of exploits (including EternalBlue and various Apache Struts/Tomcat exploits) to rapidly propagate to other servers without user interaction.</li>\n<li><strong>Encryption Routine:</strong> The ransomware targets a vast array of file extensions, utilizing strong cryptographic algorithms (typically AES-256 combined with RSA). Encrypted files are appended with the `.lucky` or `.satan` extension.</li>\n<li><strong>Defense Evasion:</strong> Before encrypting, Lucky systematically executes commands (via `vssadmin` or `bcedit`) to delete Volume Shadow Copies and disable Windows recovery modes, ensuring victims cannot restore files without the decryption key.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lucky ransomware infection is a catastrophic, Tier-1 security incident. Because of its worm-like capabilities, a single compromised server can lead to the encryption of the entire corporate infrastructure within hours, resulting in total operational downtime and massive data loss.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not just isolate the infected machine; physically disconnect critical network segments to halt the lateral spread of the ransomware via EternalBlue.</li>\n<li><strong>Do Not Reboot:</strong> Avoid rebooting infected machines. Rebooting frequently triggers secondary destructive routines or permanently erases cryptographic material resident in volatile memory that incident responders might use to recover the keys.</li>\n<li><strong>Bare-Metal Restoration:</strong> Encrypted endpoints cannot be \"cleaned.\" They must be physically isolated, securely wiped, and re-imaged using known-good installation media, followed by data restoration from offline, immutable backups.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransomware.Lucky",
    "Ransom.Satan",
    "Win32/LuckyRansom"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1210",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:00:58Z",
  "type": "Ransomware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}