{
  "family": "vortex",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nVortex is a destructive family of Ransomware (closely related to or derived from the AES-NI ransomware family) designed to infiltrate Windows systems, rapidly encrypt valuable user data, and extort the victim for financial gain. First observed around 2017, Vortex targets both individual users and enterprises, utilizing strong cryptographic algorithms to deny access to critical files and cause significant operational downtime.\n\n<h3>Infection Vector and Encryption Mechanics</h3>\nVortex is most frequently distributed via malicious spam (malspam) campaigns containing weaponized attachments or via exploit kits (such as RIG EK) hosted on compromised websites.\n\nOnce executed, the ransomware initiates its encryption routine:\n<ul>\n<li><strong>Data Encryption:</strong> The malware scans local drives and mapped network shares for a wide array of specific file extensions (documents, databases, images, archives). It utilizes robust AES-256 encryption.</li>\n<li><strong>File Modification:</strong> Encrypted files are typically appended with the `.vortex` extension (or a related AES-NI variant extension).</li>\n<li><strong>System Sabotage:</strong> Vortex actively attempts to delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy recovery of the encrypted files via Windows System Restore.</li>\n<li><strong>Extortion:</strong> It drops a ransom note (usually named `HOW_TO_DECRYPT_FILES.html` or similar) providing instructions for paying the ransom in Bitcoin via a Tor hidden service to obtain the decryption key.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Vortex infection is a critical security incident that directly impacts data availability and business continuity. While not as prevalent as modern RaaS threats, the underlying AES-NI based encryption is highly effective and difficult to crack without the key.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The infected host must be immediately disconnected from the LAN to halt the encryption of mapped network shares and sever communication with the attacker's C2 infrastructure.</li>\n<li><strong>Decryption Tools:</strong> Because Vortex is an older, AES-NI related family, the master decryption keys for several variants were eventually released. <strong>Do not pay the ransom.</strong> Organizations should check resources like the \"No More Ransom\" project or Kaspersky's RakhniDecryptor to see if a free decryptor is available for their specific variant.</li>\n<li><strong>Restore from Backup:</strong> If a decryptor is unavailable, the most reliable recovery method is to wipe the infected system completely and restore data from a clean, offline backup.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan-Ransom.Win32.Vortex",
    "Ransom.AES-NI",
    "Win32/Vortex"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:44:41Z",
  "type": "Ransomware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}