{
  "family": "aspm",
  "sample_count": 18,
  "category": "ransomware",
  "description": "Aspm (classified across security vendors as Ransom:Win32/Aspm, Trojan-Ransom.Win32.Aspm, and Ransom.Aspm) is a targeted Windows crypto-ransomware family active in corporate extortion attacks. Propagated through spear-phishing payloads delivering malicious document droppers, compromised software supply chains, and brute-forced RDP accounts, Aspm executes high-speed multi-threaded encryption routines across logical drives and connected network storage shares. Aspm executes shell commands to stop database services (such as MSSQL, Oracle, and MySQL) and purge Windows system recovery artifacts via 'vssadmin delete shadows /all /quiet' and 'wbadmin delete catalog -quiet'. Files are encrypted using AES-256 and renamed with unique machine identifiers followed by the '.aspm' extension. Aspm drops ransom notes ('ASPM_README.txt') containing instructions for accessing a Tor negotiation portal to purchase decryption keys.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Aspm",
    "Trojan-Ransom.Win32.Aspm",
    "Win32/Aspm",
    "Ransom.Aspm",
    "Aspm Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Aspm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Aspm is a Windows crypto-ransomware family that encrypts corporate files and databases using AES-256 and RSA cryptography."
      }
    },
    {
      "@type": "Question",
      "name": "How does Aspm disable system recovery mechanisms?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin and wbadmin commands to delete volume shadow copies and system backup catalogs."
      }
    },
    {
      "@type": "Question",
      "name": "How is Aspm delivered to victim environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through spear-phishing documents, compromised software updates, and brute-forced RDP connections."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted by Aspm be restored without paying?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Restoration is only possible through verified offline backups, as Aspm uses standard AES-256 with asymmetric RSA key protection."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures prevent Aspm infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Implement multi-factor authentication on all remote access points, isolate critical database backups, and deploy behavioral EDR monitoring."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1489",
    "T1083",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spear-phishing Emails with Weaponized Attachments",
    "Compromised Remote Desktop Protocol (RDP)",
    "Third-Party Software Supply Chain Compromise"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows Server 2016"
  ],
  "capabilities": [
    "Hybrid Cryptography (AES-256 + RSA)",
    "Shadow Copy & System Backup Catalog Deletion",
    "Database & Security Service Termination",
    "Multi-threaded Local & Network Share Traversal",
    "Automated Ransom Note Drop"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound connections to Tor onion negotiation portals",
      "SMB network scanning traffic mapping accessible shares"
    ],
    "evasion_techniques": [
      "Code obfuscation and encrypted string tables to defeat static signatures",
      "Process termination of antivirus and security monitoring agents"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "293a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a",
      "3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AspmLocker"
    ],
    "file_paths": [
      "%AppData%\\Aspm\\aspm.exe",
      "C:\\ASPM_README.txt"
    ]
  },
  "defensive_measures": [
    "Implement strict network segmentation to restrict lateral movement across corporate subnets",
    "Maintain immutable, offline backups to ensure business continuity without paying ransoms",
    "Enforce endpoint detection and response (EDR) rules alerting on unauthorized service terminations"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Aspm",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Aspm"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Aspm",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Aspm.A",
      "Ransom:Win32/Aspm.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Corporate Data Encryption",
  "sample_hashes": []
}