{
  "family": "troldesh",
  "sample_count": 14,
  "category": "ransomware",
  "description": "Ransomware:Win32/Troldesh, universally known in the cybersecurity community as **Shade Ransomware**, was an extremely prolific and destructive Russian-origin ransomware family highly active between 2014 and 2020. Troldesh was infamous for its massive distribution via malspam, its robust encryption utilizing multiple distinct extensions (e.g., `.xtbl`, `.ytbl`, `.rsa3072`), and its unique capability to also act as a downloader for secondary botnet payloads.<br><br><b>Understanding Shade (Troldesh)</b><br>To a victim, a Troldesh infection resulted in the complete lockdown of personal files and databases, often with filenames appended with a long string of characters and an `.xtbl` extension. The desktop wallpaper was replaced with a ransom note in Russian and English. For a security analyst, Troldesh was a complex threat. It utilized strong AES-256 encryption with RSA-3072 key exchange. Notably, in 2020, the operators behind Shade unexpectedly shut down their operation and released over 750,000 decryption keys to the public, allowing security researchers to create a universal, free decryptor.<br><br><b>Execution and Extortion Mechanics</b><br>Troldesh was primarily distributed via massive phishing campaigns containing malicious ZIP attachments (often JavaScript or VBScript droppers) (`T1566.001`) or via Exploit Kits. Upon execution, the payload copies itself to the `C:\\ProgramData` or `%AppData%` directory under a benign-sounding name and establishes persistence via Registry Run keys (`T1547.001`). It reaches out to Tor-hosted C2 servers to acquire a public RSA encryption key (`T1090.003`). Troldesh then rapidly encrypts target files (`T1486`). Uniquely, Troldesh also contained functionality to download and execute secondary malware payloads (often click-fraud bots or infostealers) onto the infected machine (`T1105`), maximizing the attacker's revenue.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was devastating data loss and extortion, coupled with secondary malware infections. EDR platforms would alert on rapid, massive file modification events across the disk. Network logs would show the malware attempting to establish connections to the Tor network (often using hardcoded Tor gateways). The presence of `.xtbl`, `.ytbl`, or `.breaking_bad` file extensions and `README.txt` ransom notes are definitive IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1090.003",
    "T1105",
    "T1547.001",
    "T1486",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1090.003",
      "name": "Connection Proxy: Multi-hop Proxy (Tor)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Secondary Payloads)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to prevent the ransomware from enumerating and encrypting shared network drives (SMB shares) and to sever C2 communications.",
    "Do NOT pay the ransom. Navigate to the 'No More Ransom' project; a universal, free decryptor (Shade Decryptor by Kaspersky) is available for all variants of Troldesh.",
    "Use EDR or Process Explorer to terminate the active Troldesh encryption process before utilizing the decryptor.",
    "Perform a deep system scan after decryption, as Troldesh frequently downloaded secondary infostealers and botnet components."
  ],
  "what_to_avoid": [
    "Do not delete the encrypted files or the original ransom notes, as the free decryption tools often require information from the ransom note to identify the correct key.",
    "Avoid restarting the computer if the encryption process is actively running, as this can corrupt files currently being processed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}