{
  "family": "sagecrypt",
  "sample_count": 6,
  "category": "ransomware",
  "description": "Ransom:Win32/Sagecrypt (widely known as **Sage 2.0**) is a highly sophisticated ransomware family that gained prominence in 2017. It is notable for being heavily distributed by massive botnets (like the ones that delivered Locky and Cerber) and for its use of strong, unbroken encryption algorithms. It encrypts a victim's files, appends the `.sage` extension to them, and demands payment in Bitcoin via a dedicated Tor hidden service.<br><br><b>Understanding the Sage Ransomware Threat</b><br>To an organization, Sagecrypt is a devastating threat. It is designed for maximum damage, encrypting not just local files, but also aggressively scanning for and encrypting accessible network shares and removable drives. Security analysts note Sage 2.0 for its professional infrastructure; the payment portals are often translated into dozens of languages and feature live chat support to 'assist' victims in buying Bitcoin.<br><br><b>Execution and Encryption Mechanics</b><br>Sagecrypt is primarily delivered via massive phishing campaigns (`T1566.001`) utilizing weaponized ZIP files containing malicious JavaScript or Word macros. Once executed, it profiles the system (`T1082`) and uses `vssadmin.exe` and `wbadmin.exe` to delete Windows Volume Shadow Copies and backup catalogs, preventing simple recovery (`T1490`). It utilizes the ChaCha20 symmetric algorithm to encrypt the files rapidly, and an RSA public key to encrypt the ChaCha20 keys (`T1486`). This hybrid approach ensures the files cannot be decrypted without the attacker's private key. Sage drops a ransom note named `!Recovery_[random_chars].html`.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is total data loss across the endpoint and accessible network shares. Host-based IoCs include EDR alerts for the execution of command-line tools aimed at inhibiting recovery (e.g., `vssadmin.exe Delete Shadows /All /Quiet`). The most obvious indicator is the mass renaming of files to include the `.sage` extension, accompanied by massive CPU and disk I/O spikes. Network IoCs include the malware attempting to resolve the attacker's Tor payment gateway domains via public DNS servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1082",
    "T1486",
    "T1490"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (ChaCha20/RSA encryption)",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Shadow Copies via vssadmin)",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Initial delivery via macros/JS)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery (Profiling for network shares)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the infected endpoint from the network to halt the encryption of mapped network drives and SMB shares.",
    "Do not restart the machine, as this may trigger a wiper routine or destroy forensic artifacts in RAM that could contain the symmetric key.",
    "Identify the initial phishing vector and purge the malicious email from the Exchange server to prevent lateral spread.",
    "Initiate the corporate Incident Response plan and begin restoring data from offline, immutable backups."
  ],
  "what_to_avoid": [
    "Do not pay the ransom unless absolutely necessary for business continuity; payment does not guarantee data recovery and funds organized crime.",
    "Avoid reconnecting the infected machine to the network until it has been completely wiped and reimaged."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}