{
  "family": "stop",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Ransomware:Win32/Stop (widely known as STOP/Djvu) is arguably the most widely distributed ransomware family in the world by raw infection volume. Unlike enterprise-focused cartels (like LockBit or ALPHV), STOP/Djvu almost exclusively targets home users and consumers. It achieves massive scale by embedding itself entirely within the ecosystem of software piracy: cracked software, keygens, and torrents (`T1566.002`).<br><br><b>Understanding STOP / Djvu (Consumer Ransomware)</b><br>To a home user, the infection is devastating: personal photos, documents, and game saves are encrypted, appended with a 4-letter extension (e.g., `.djvu`, `.rumba`, `.qewe`), and a `_readme.txt` file demands a ransom (usually $490-$980 in Bitcoin). For security researchers, STOP is notable for its sheer volume and its secondary payload: it almost always drops the RedLine or Vidar infostealer (`T1056`) *before* encrypting, ensuring the attackers profit from stolen credentials even if the victim refuses to pay the ransom.<br><br><b>Execution and Cryptographic Mechanics</b><br>STOP/Djvu is distributed via drive-by downloads on illegal software cracking sites. When the user executes the 'crack', the ransomware runs. It disables Windows Defender, kills running processes (to free up files for encryption), and contacts its C2 server to retrieve a unique 'Online' RSA public key (`T1486`). If the C2 server is unreachable, it defaults to a hardcoded 'Offline' key (which security researchers have often managed to crack). It then uses Salsa20 to encrypt files. Crucially, it modifies the Windows `HOSTS` file (`T1562.002`) to block access to security vendor websites, preventing the victim from downloading help or decryptors.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total personal data loss and the theft of all browser passwords and session cookies (via the bundled infostealer). Host-based IoCs include files appended with the specific variant's 4-letter extension, the presence of the `_readme.txt` ransom note, and modifications to `C:\\Windows\\System32\\drivers\\etc\\hosts` blocking sites like BleepingComputer or Microsoft. Network IoCs include the initial beacon to the C2 server to retrieve the encryption key.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1566.002",
    "T1056",
    "T1562.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (The core ransomware payload)",
      "tactic": "Impact"
    },
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link (Distribution via malicious torrents and software crack sites)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.002",
      "name": "Impair Defenses: Disable Windows Event Logging (Modifying HOSTS file to block security sites)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056",
      "name": "Input Capture (Deploying secondary infostealers like RedLine prior to encryption)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the infected machine from the network. Do NOT reboot it, as live memory may hold the offline encryption keys.",
    "Determine if the encryption used an 'Online' or 'Offline' key (Emsisoft provides a free tool for this); offline keys can often be decrypted for free.",
    "Assume all passwords saved in the web browser (email, banking, social media) have been stolen by the bundled infostealer; reset them from a clean device.",
    "Check the `HOSTS` file and remove entries blocking security websites so you can download necessary removal tools."
  ],
  "what_to_avoid": [
    "Do not pay the ransom. STOP/Djvu operators have a terrible track record of actually providing working decryptors after payment.",
    "Avoid focusing solely on the encryption; you must assume an infostealer ran first, meaning a full credential reset is mandatory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}