{
  "family": "zepto",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nZepto is a highly destructive ransomware variant that gained massive notoriety in mid-2016. It is a direct evolution (and effectively a rebranded version) of the infamous Locky ransomware family. Zepto utilizes military-grade encryption to lock a victim's critical data, appends the `.zepto` extension to affected files, and demands a cryptocurrency ransom, causing immediate and catastrophic operational downtime.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZepto was primarily distributed through massive, automated spam campaigns orchestrated by the Necurs botnet. The phishing emails typically contained malicious `.zip` archives housing weaponized JavaScript (`.js`) or Visual Basic Script (`.vbs`) files, or `.docm` files with malicious macros.\n\nOnce the script is executed, Zepto operates with devastating efficiency:\n<ul>\n<li><strong>Evasion and C2 Communication:</strong> The malware often uses a Domain Generation Algorithm (DGA) to rapidly locate its command-and-control servers. It securely negotiates and receives the public RSA key required to begin the encryption process.</li>\n<li><strong>Rapid File Encryption:</strong> Zepto scans local drives, removable media, and specifically targets all mapped and unmapped network shares. It encrypts files using a hybrid RSA-2048 and AES-128 algorithm, replacing the original filename and appending the `.zepto` extension.</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Zepto executes commands (such as `vssadmin.exe delete shadows /all /quiet`) to instantly destroy Windows Volume Shadow Copies and disable local backup routines.</li>\n<li><strong>Extortion:</strong> After encryption, it drops a ransom note (often `_HELP_instructions.html` and `.bmp` files) in every affected directory and changes the desktop wallpaper to display the payment demands.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zepto infection is a catastrophic security incident resulting in massive data loss. Due to the strength of the RSA/AES hybrid encryption, files cannot be recovered without the private key held by the attackers or a viable offline backup.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Physical Isolation:</strong> Disconnect the infected machine from the network immediately (pull the Ethernet cable/disable Wi-Fi) to halt the encryption process and prevent the ransomware from traversing SMB shares to encrypt centralized file servers.</li>\n<li><strong>Do Not Reboot:</strong> Leave the machine powered on. Rebooting may trigger further destructive routines or destroy the encryption key if it temporarily resides in RAM.</li>\n<li><strong>Restore from Offline Backups:</strong> The only reliable remediation is to completely wipe the infected system (bare-metal reinstall) and restore the data from secure, offline backups that were unreachable by the ransomware.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransomware.Zepto",
    "Trojan-Ransom.Win32.Locky.Zepto",
    "Filecoder.Zepto"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1059.005",
    "T1568.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:22:16Z",
  "type": "Ransomware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}