{
  "family": "satwancrypt",
  "sample_count": 7,
  "category": "ransomware",
  "description": "Ransom:Win32/Satwancrypt is a destructive ransomware strain designed to infiltrate corporate networks, encrypt critical business data, and extort organizations for financial gain. Like most modern ransomware families, Satwancrypt focuses on rapid encryption and ensuring backups are destroyed before the victim is presented with the ransom demand.<br><br><b>Understanding the Satwancrypt Threat</b><br>To an infected user, the outcome is catastrophic: documents, databases, and critical files are suddenly inaccessible, their filenames often altered to include a specific extension (e.g., `.satwan`). A ransom note (usually a `.txt` or `.hta` file) is dropped in every encrypted directory, demanding payment in cryptocurrency (Bitcoin or Monero) in exchange for the decryption key. For a security operations center (SOC), a Satwancrypt detonation represents the final, most visible stage of a potentially prolonged network compromise.<br><br><b>Execution and Encryption Mechanics</b><br>Satwancrypt is typically deployed manually by attackers after they have gained deep access to the network via Initial Access Brokers (IABs) utilizing compromised RDP credentials (`T1133`) or unpatched VPN vulnerabilities (`T1190`). Once deployed via Group Policy or PsExec (`T1569.002`), the ransomware first attempts to neutralize endpoint defenses (`T1562.001`). Crucially, it executes a series of commands (often `vssadmin.exe Delete Shadows /All /Quiet`) to destroy Windows Volume Shadow Copies (`T1490`), preventing the victim from easily restoring files locally. It then rapidly encrypts targeted files (`T1486`) using strong cryptographic algorithms (typically AES paired with RSA), ensuring the files cannot be decrypted without the attacker's private key.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe operational downtime and potential permanent data loss. The primary IoC is the massive, rapid modification of files across the hard drive and network shares, and the appearance of the ransom note. Host-based IoCs include EDR alerts for the mass deletion of shadow copies and the sudden termination of database and backup services (like SQL or Exchange) to unlock files for encryption.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1569.002",
    "T1490"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Volume Shadow Copies)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Killing AV processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1569.002",
      "name": "System Services: Service Execution (Deploying via PsExec)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly isolate the infected endpoint from the network to halt the encryption process, explicitly disconnecting it from mapped network shares and cloud syncing services.",
    "Do NOT reboot the machine immediately; capture a live memory dump (RAM) first, as poorly coded ransomware sometimes leaves the encryption keys in memory.",
    "Identify the specific variant and check 'NoMoreRansom.org' to see if a free decryption tool has been developed by security researchers.",
    "If no decryptor is available, wipe the infected systems and restore data from secure, immutable offline backups."
  ],
  "what_to_avoid": [
    "Do not pay the ransom. Paying funds criminal enterprises, and there is no guarantee the attackers will provide a working decryption tool.",
    "Avoid reconnecting the machine to the network until a full forensic investigation has determined the initial entry vector (e.g., how did the attackers get in to deploy the ransomware?)."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}