{
  "family": "thanatos",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Ransom:Win32/Thanatos is a notorious **Cryptographic Ransomware** family, but it is infamous for a critical and catastrophic implementation flaw: it is effectively a Wiper. While Thanatos encrypts user files and demands a ransom in Bitcoin, Ethereum, or other cryptocurrencies, the malware authors made a fundamental error in their code: *they did not save the generated encryption keys anywhere*. This means that even if a victim pays the ransom, the attackers mathematically cannot decrypt the data.<br><br><b>Understanding Thanatos (The Accidental Wiper)</b><br>To an end-user, the impact is devastating. Files are rendered inaccessible, appended with the `.THANATOS` extension, and a `README.txt` ransom note is displayed. For a security analyst, Thanatos highlights the extreme risk of engaging with cybercriminals. Because it generates a *new, separate encryption key for every single file* and discards that key in memory once the encryption process is complete, the original data is permanently destroyed (`T1485`).<br><br><b>Execution and Flawed Cryptography</b><br>Thanatos was typically distributed via malspam campaigns containing malicious attachments or URLs (`T1566`). Upon execution (`T1204.002`), it establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key (`T1547.001`). The malware uses the Windows Cryptography API (bcrypt) to generate AES-256 keys. However, instead of encrypting these AES keys with a hardcoded attacker public RSA key (the standard ransomware model), Thanatos simply encrypts the file (`T1486`) and lets the AES key vanish from memory. Furthermore, it actively attempts to inhibit system recovery by terminating backup processes and deleting Volume Shadow Copies (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total data loss. Host-based IoCs include EDR alerts for mass file modification, the execution of `vssadmin.exe delete shadows`, the presence of the `.THANATOS` file extension, and the `README.txt` ransom note demanding varied cryptocurrencies (unlike most ransomware which demands a single type).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1547.001",
    "T1485",
    "T1490"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1485",
      "name": "Data Destruction (Due to flawed cryptography)",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "IMMEDIATELY disconnect the infected endpoint from the network to prevent the ransomware from iterating through mapped network drives.",
    "Do not attempt to reboot the machine while encryption is ongoing; if possible, capture a live memory dump, as the encryption keys for *currently processing* files might still briefly exist in RAM.",
    "Restore all affected systems from secure, offline backups. There is no mathematical way to decrypt Thanatos-encrypted files.",
    "Identify the initial vector (e.g., the specific phishing email) and block the sender domain and associated malicious URLs."
  ],
  "what_to_avoid": [
    "NEVER PAY THE RANSOM for Thanatos. It is a technical impossibility for the attackers to recover your files.",
    "Avoid relying solely on Volume Shadow Copies for backups, as Thanatos (like almost all modern ransomware) actively deletes them."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}