{
  "family": "ardurk",
  "sample_count": 18,
  "category": "ransomware",
  "description": "Ardurk (tracked across threat intelligence repositories under signatures including Ransom:Win32/Ardurk, Trojan-Ransom.Win32.Ardurk, and Ransom.Ardurk) is a targeted Windows crypto-ransomware family designed for rapid local disk and network share encryption. Propagated through compromised Remote Desktop Protocol (RDP) sessions, weaponized email loaders, and corporate VPN credential stuffing attacks, Ardurk prioritizes rapid encryption of high-value business assets. Upon execution, Ardurk executes commands via cmd.exe to terminate database, hypervisor, and backup services (such as MSSQL, MySQL, Oracle, and Veeam services) to release file locks on critical business databases. It purges volume shadow copies and system state backups using 'vssadmin delete shadows /all /quiet' and disables Windows automatic boot recovery via 'bcdedit /set {default} bootstatuspolicy ignoreallfailures'. Ardurk then encrypts user documents, financial databases, virtual machine disks, and system archives using AES-256 in CBC mode, appending the '.ardurk' extension to encrypted files. It encrypts the AES session key using an embedded 2048-bit RSA master public key and creates ransom notes ('HOW_TO_RESTORE_ARDURK.txt') in all processed directories.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Ardurk",
    "Trojan-Ransom.Win32.Ardurk",
    "Win32/Ardurk",
    "Ransom.Ardurk",
    "Ardurk Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Ardurk?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ardurk is a targeted Windows crypto-ransomware family that encrypts corporate databases and files using AES-256 and RSA-2048."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ardurk disable Windows system recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to delete volume shadow copies and bcdedit commands to suppress startup recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ardurk infect corporate environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers deploy Ardurk via compromised RDP credentials, enterprise VPN breaches, and phishing document loaders."
      }
    },
    {
      "@type": "Question",
      "name": "Can files with the .ardurk extension be decrypted for free?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No public decrypter exists because Ardurk uses strong AES-256 encryption with keys protected by an asymmetric RSA master public key."
      }
    },
    {
      "@type": "Question",
      "name": "What steps should be taken during an active Ardurk ransomware attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate affected network segments immediately, capture memory images of infected hosts, and restore data from verified air-gapped backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1489",
    "T1083",
    "T1078"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Compromised Remote Desktop Protocol (RDP) Sessions",
    "Spear-phishing Emails with Macro Documents",
    "Compromised Enterprise VPN Accounts"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows Server 2016"
  ],
  "capabilities": [
    "Hybrid Cryptography (AES-256-CBC + RSA-2048)",
    "Volume Shadow Copy & Backup Catalog Destruction",
    "Database & Hypervisor Service Termination",
    "Local Storage & Network Share Traversal",
    "Automated Ransom Note Placement"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Win64 PE Executable"
    ],
    "network_signatures": [
      "Outbound connections to Tor proxy bridges or anonymous negotiation portals",
      "SMB reconnaissance traffic enumerating shared folders across internal subnets"
    ],
    "evasion_techniques": [
      "Terminating antivirus and endpoint monitoring processes prior to encryption",
      "Obfuscating executable sections with custom PE protectors"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "0718293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e",
      "18293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ArdurkLocker"
    ],
    "file_paths": [
      "%AppData%\\Ardurk\\ardurk.exe",
      "C:\\HOW_TO_RESTORE_ARDURK.txt"
    ]
  },
  "defensive_measures": [
    "Enforce strict multi-factor authentication on all external-facing remote access endpoints",
    "Maintain immutable, air-gapped backups that cannot be modified via administrative Windows credentials",
    "Deploy endpoint detection and response (EDR) rules alerting on execution of vssadmin delete shadows"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Ardurk",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ardurk"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Ardurk",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Ardurk.A",
      "Ransom:Win32/Ardurk.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Corporate Ransom Demands",
  "sample_hashes": []
}