Troldesh

Overview

Troldesh (widely tracked across the intelligence community as Shade or Encrypter.JPHP) is a notorious Russian-speaking ransomware family first active in late 2014. Troldesh earned international attention for its idiosyncratic behavior: its ransom notes often contained Russian poetry and philosophical passages, and it cycled through numerous distinctive file extensions including `.crypted`, `.xtbl`, `.ytbl`, and `.breaking_bad`. Troldesh utilized AES-256 in CBC mode to encrypt victim data, protecting the key with asymmetric RSA-2048 encryption. In April 2020, the operators of Troldesh executed an extraordinary and voluntary exit: they published a public apology on GitHub and hacker forums ('We are the team which created a trojan-encryptor known as Shade, Troldesh... we made a decision to put an end to this story and to publish the rest of decryption keys'), releasing over 750,000 private decryption keys. Security vendors including Kaspersky Lab and Group-IB verified the keys and updated the free 'ShadeDecryptor' utility, allowing all remaining historical victims worldwide to recover their encrypted data free of charge.

Known aliases

Threat reports may refer to this family under multiple names:

• Troldesh
• Shade
• Trojan.Troldesh
• Ransom.Shade
• Win32/Troldesh

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Shade / Troldesh Cybercrime Collective / April 2020 Public Master Key Release High confidence
  Basis: Active Russian cybercrime group from 2014 to 2020. In April 2020, the operators voluntarily terminated the project, issued a public apology, and released over 750,000 decryption keys on GitHub used by Kaspersky to decrypt all victims. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Troldesh V1.0 (.Crypted) · Troldesh V2.0 (.Xtbl) · Troldesh V3.0 (.Breaking_Bad) · Encrypter.Jphp (Master Key Release)

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2015-5119 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2017-0199 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c
• 4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b

Delivery vectors

• Malicious email attachments disguised as financial invoices containing embedded macros or VBScript (CVE-2017-0199)
• Exploit kits delivering weaponized payloads via Adobe Flash vulnerabilities (CVE-2015-5119)

Persistence mechanisms

• Deletes Windows Volume Shadow Copies using vssadmin.exe
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run autorun key installation

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_TROLDESH_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Troldesh"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "troldesh" ascii wide nocase
        $s2 = "troldesh" ascii wide nocase
        $s3 = "shade" ascii wide nocase
        $s4 = "trojan.troldesh" ascii wide nocase
        $s5 = "ransom.shade" ascii wide nocase
        $s6 = "win32/troldesh" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Troldesh (Ransomware) Execution & Triage
id: 7334566f-9392-5a2a-b536-e248b80280af
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Troldesh malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/troldesh
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1486
- attack.t1490
- attack.t1071_001
- attack.t1566_001
- attack.t1547_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_TROLDESH_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Troldesh tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "troldesh" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to prevent the ransomware from enumerating and encrypting shared network drives (SMB shares) and to sever C2 communications.
2. Do NOT pay the ransom. Navigate to the 'No More Ransom' project; a universal, free decryptor (Shade Decryptor by Kaspersky) is available for all variants of Troldesh.
3. Use EDR or Process Explorer to terminate the active Troldesh encryption process before utilizing the decryptor.
4. Perform a deep system scan after decryption, as Troldesh frequently downloaded secondary infostealers and botnet components.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not delete the encrypted files or the original ransom notes, as the free decryption tools often require information from the ransom note to identify the correct key.
2. Avoid restarting the computer if the encryption process is actively running, as this can corrupt files currently being processed.

References & External Analysis

• Kaspersky Securelist - Shade Ransomware: The Story is Over
• Group-IB - Analysis of Shade / Troldesh Decryption Keys
• MITRE ATT&CK - Shade
• Search "troldesh" on VirusTotal (External Analysis)
• Search "troldesh" on Any.Run (Sandbox Sandbox)
• Search "troldesh" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Matsnu
• Tarifarch
• Sysdrop
• Toga
• Bluteal
• Sloddat
• Kavos
• Giri

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/troldesh.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.