{
  "family": "adject",
  "sample_count": 15,
  "category": "ransomware",
  "description": "Adject (classified across antivirus engines as Ransom:Win32/Adject, Trojan-Ransom.Win32.Adject, and Win32/Adject) is a targeted crypto-ransomware family designed to execute rapid file encryption across Windows endpoints. Distributed via malvertising campaigns, malicious document attachments, and compromised RDP access, Adject terminates running office and database processes to clear file locks before encryption. It leverages AES-256 symmetric encryption to lock files and appends .adject to filenames, placing ransom notes titled HOW_TO_RESTORE_ADJECT.txt in affected directories. To ensure payment compliance, Adject executes shell commands to purge Volume Shadow Copies via vssadmin and disables Windows recovery mode.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Adject",
    "Trojan-Ransom.Win32.Adject",
    "Win32/Adject",
    "Adject Ransomware",
    "Ransom.Adject"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Adject?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Adject is a crypto-ransomware family that encrypts files on Windows endpoints using AES-256 and demands ransom payment."
      }
    },
    {
      "@type": "Question",
      "name": "How does Adject prevent file locking errors during encryption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans and terminates processes associated with Microsoft Office, database engines, and backup utilities before encrypting."
      }
    },
    {
      "@type": "Question",
      "name": "How does Adject defeat Windows recovery features?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and configures bcdedit to ignore boot failures and disable startup recovery."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are targeted by Adject ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets documents, databases, spreadsheets, archives, and virtual machine images across local and network drives."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise respond to an Adject infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected endpoints, preserve encrypted samples and ransom notes for investigation, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Adject from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Adject persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Adject attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Adject modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Adject dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Adject",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Adject"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}