{
  "family": "azden",
  "sample_count": 17,
  "category": "ransomware",
  "description": "Azden (classified across security vendors as Ransom:Win32/Azden, Trojan-Ransom.Win32.Azden, and Win32/Azden) is a targeted Windows crypto-ransomware family designed for corporate network extortion. Propagated through brute-forced Remote Desktop Protocol (RDP) sessions, compromised enterprise VPN credentials, and malicious email droppers, Azden executes high-speed file encryption across local drives and accessible network shares. Prior to encrypting files, Azden terminates database and hypervisor services (such as MSSQL, MySQL, Oracle, and Veeam services) to release file locks on critical business databases. It deletes volume shadow copies using 'vssadmin delete shadows /all /quiet' and disables Windows boot recovery prompts via bcdedit ('bcdedit /set {default} bootstatuspolicy ignoreallfailures'). Azden encrypts user documents, financial databases, virtual machine disks, and system archives using AES-256 in CBC mode, appending the '.azden' extension to encrypted files. It encrypts the AES session key using an embedded 2048-bit RSA master public key and creates ransom notes ('HOW_TO_RESTORE_AZDEN.txt') in all processed directories.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Azden",
    "Trojan-Ransom.Win32.Azden",
    "Win32/Azden",
    "Ransom.Azden",
    "Azden Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Azden?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Azden is a corporate-targeting crypto-ransomware that encrypts business databases and network shares using AES-256 and RSA-2048."
      }
    },
    {
      "@type": "Question",
      "name": "How does Azden disable system recovery mechanisms?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to delete volume shadow copies and bcdedit commands to suppress startup recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "How does Azden compromise corporate networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Adversaries deploy Azden via brute-forced RDP accounts, compromised VPN credentials, and spear-phishing loaders."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted with the .azden extension be decrypted for free?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No public decrypter exists because Azden uses strong AES-256 with keys protected by an asymmetric RSA master public key."
      }
    },
    {
      "@type": "Question",
      "name": "What incident response actions should be taken during an Azden attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate affected network segments immediately, capture memory images of infected hosts, and restore data from verified air-gapped backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1489",
    "T1083",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Compromised Remote Desktop Protocol (RDP) Credentials",
    "Spear-phishing Emails with Macro Documents",
    "Compromised Enterprise VPN Accounts"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows Server 2016"
  ],
  "capabilities": [
    "Hybrid Cryptography (AES-256-CBC + RSA-2048)",
    "Volume Shadow Copy & Boot Recovery Deletion",
    "Database & Hypervisor Service Termination",
    "Network Share Traversal & Lateral Encryption",
    "Automated Ransom Note Placement"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Win64 PE Executable"
    ],
    "network_signatures": [
      "Outbound connections to Tor proxy bridges or anonymous negotiation portals",
      "SMB network scanning traffic mapping open administrative shares"
    ],
    "evasion_techniques": [
      "Terminating security software processes to prevent behavioral blocking",
      "Dynamic API resolution to hide cryptographic and file traversal functions"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d",
      "2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AzdenLocker"
    ],
    "file_paths": [
      "%AppData%\\Azden\\azden.exe",
      "C:\\HOW_TO_RESTORE_AZDEN.txt"
    ]
  },
  "defensive_measures": [
    "Maintain immutable, air-gapped backups to ensure business continuity without paying ransoms",
    "Enforce strict multi-factor authentication on all external-facing remote access endpoints",
    "Deploy endpoint detection and response (EDR) rules alerting on execution of vssadmin delete shadows"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Azden",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Azden"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Azden",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Azden.A",
      "Ransom:Win32/Azden.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Corporate Ransom Demands",
  "sample_hashes": []
}