Crusis

Overview

Crusis (widely known in the cybersecurity community as the CrySiS or Dharma ransomware family and cataloged by Microsoft as Ransom:Win32/Crusis) is an infamous targeted ransomware threat active since 2016. Attacking corporate networks primarily by brute-forcing weakly configured Remote Desktop Protocol (RDP) connections and exploiting vulnerable internet-exposed remote management services, Crusis operators manually execute intrusion operations. Once inside a network, operators deploy administrative tools, terminate database and backup software, and execute Crusis. The ransomware encrypts targeted files across fixed, removable, and network-mapped drives using AES-256 and RSA-1024 encryption, renaming files with dynamic extensions (such as .crusis, .dharma, or .wallet) alongside the attacker's contact email address. Crusis purges Volume Shadow Copies using vssadmin and leaves extortion notes instructing victims on Bitcoin payments.

Known aliases

Threat reports may refer to this family under multiple names:

• Ransom:Win32/Crusis
• Trojan-Ransom.Win32.Crusis
• CrySiS
• Dharma
• Ransom:Win32/Crusis.A

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_CRUSIS_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Crusis"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "crusis" ascii wide nocase
        $s2 = "ransom:win32/crusis" ascii wide nocase
        $s3 = "trojan-ransom.win32.crusis" ascii wide nocase
        $s4 = "crysis" ascii wide nocase
        $s5 = "dharma" ascii wide nocase
        $s6 = "ransom:win32/crusis.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Crusis (Ransomware) Execution & Triage
id: 16513a9c-054d-56ba-b598-1c2c9a4d49ed
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Crusis malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/crusis
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1133
- attack.t1486
- attack.t1490
- attack.t1083
- attack.t1070_004
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_CRUSIS_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Crusis tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "crusis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately disable internet-exposed RDP access and isolate infected network segments.
2. Kill active Crusis processes and batch scripts using Task Manager or PowerShell.
3. Capture memory forensics from infected domain controllers and file servers before rebooting.
4. Audit Active Directory user accounts for newly created unauthorized administrative profiles.
5. Restore encrypted files from verified, air-gapped offline backups.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not pay the cryptocurrency extortion demand; payment fuels future attacks and key recovery is never assured.
2. Do not leave default RDP port 3389 exposed to the public internet without VPN and MFA safeguards.

References & External Analysis

• Microsoft Defender Threat Encyclopedia - Ransom:Win32/Crusis
• CISA Cybersecurity Advisory - CrySiS/Dharma Ransomware Analysis
• Trend Micro Threat Encyclopedia - Ransom_Crysis
• Search "crusis" on VirusTotal (External Analysis)
• Search "crusis" on Any.Run (Sandbox Sandbox)
• Search "crusis" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Seeav
• Jord
• Globim
• Donloz
• Macrodrop
• Perseus
• Gendal
• Klone

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/crusis.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.