{
  "family": "shade",
  "sample_count": 72,
  "category": "ransomware",
  "description": "Ransomware:Win32/Shade (also known as Troldesh) is a historically devastating, highly prolific ransomware strain originating from Russia, notorious for its widespread distribution via malspam, its robust encryption, and its use of the Tor network for C2 communication.<br><br><b>Understanding Shade (Troldesh)</b><br>For the victim, a Shade infection is catastrophic. Their files are encrypted (appended with extensions like `.xtbl`, `.ytbl`, or `.breaking_bad`), the desktop wallpaper is changed to a ransom note (often in Russian and English), and they are directed to a Tor hidden service to pay the ransom. For incident responders, Shade was a dominant threat from 2014 until its operators surprisingly released all decryption keys and shut down the operation in 2020. Despite this, legacy infections and modified variants still pose a threat.<br><br><b>Execution and Evasion Strategies</b><br>Shade was primarily distributed via massive, indiscriminate malspam campaigns containing malicious ZIP attachments or exploit kits. Upon execution, the malware copies itself to `%ProgramData%` or `%AppData%` and establishes persistence via Registry Run keys. It immediately deletes Volume Shadow Copies (`vssadmin.exe`) to prevent recovery. Crucially, Shade reaches out to its C2 server over Tor (or via a hardcoded list of proxies) to obtain a public RSA key. It then encrypts files using AES-256, encrypting the AES key with the RSA public key. If the C2 is unreachable, it uses a hardcoded fallback RSA key. Interestingly, older versions of Shade would download additional malware (like the TeamViewer RAT) if it detected the machine was running accounting software in Russia.<br><br><b>Indicators of Compromise & Impact</b><br>The primary indicator is the rapid encryption of files and the presence of `README.txt` ransom notes. EDR platforms will trigger on mass file modifications and the execution of `vssadmin.exe Delete Shadows`. Network logs will show anomalous DNS requests or HTTP traffic attempting to connect to Tor proxies or known Shade C2 IP addresses.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1090.003",
    "T1566.001",
    "T1486",
    "T1490"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately sever the infected endpoint and any mapped network shares from the corporate network to halt the spread of the encryption process.",
    "Do NOT reboot the machine immediately; capture a forensic RAM image, as memory analysis may reveal the AES encryption keys if the process is still running.",
    "Verify if the specific variant is covered by the public release of the Shade decryption keys (available via NoMoreRansom); decryption may be possible without paying.",
    "Initiate disaster recovery protocols using offline, immutable backups if decryption is not possible."
  ],
  "what_to_avoid": [
    "Do not connect any external drives or network shares to the infected machine, as the ransomware will immediately attempt to encrypt them.",
    "Avoid paying the ransom; the official Shade operators have shut down, and payments will likely go to copycats who cannot provide the key."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}