{
  "family": "betload",
  "sample_count": 15,
  "category": "ransomware",
  "description": "Betload (classified as Ransom:Win32/Betload, Trojan:Win32/Betload, and TrojanDownloader:Win32/Betload) is a hybrid trojan loader and ransomware payload observed in multi-stage crimeware campaigns. Distributed primarily through compromised gaming forums, trojanized gambling utilities, and deceptive cracked software archives, Betload establishes persistence via registry Run keys before performing network host reconnaissance. If specific enterprise target conditions are met, Betload unpacks its embedded crypto-ransomware module, encrypting user documents, databases, and media files with AES-256 while dropping extortion notes demanding cryptocurrency ransom payments. Betload disables Windows recovery features and deletes local shadow copies to maximize extortion leverage.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Betload",
    "Trojan:Win32/Betload",
    "TrojanDownloader:Win32/Betload",
    "Win32/Betload",
    "Betload Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Betload?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Betload is a hybrid trojan downloader and ransomware payload that infiltrates Windows hosts to deliver cryptographic extortion modules."
      }
    },
    {
      "@type": "Question",
      "name": "How is Betload distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via deceptive software cracks, trojanized gambling and gaming utilities, and malicious email attachments."
      }
    },
    {
      "@type": "Question",
      "name": "What encryption methods does Betload employ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses AES-256 symmetric encryption to lock files and appends custom extensions to affected documents."
      }
    },
    {
      "@type": "Question",
      "name": "How does Betload establish persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes executable paths into HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creates scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken against Betload?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quarantine the host, remove registry autoruns, submit file hashes to security feeds, and restore systems from clean backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1105",
    "T1547.001",
    "T1490",
    "T1083",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Betload from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Betload persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Betload attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Betload modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Betload dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Betload",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Betload"
    },
    {
      "name": "Trend Micro Security Research - Trojan.Win32.Betload Overview",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.betload"
    },
    {
      "name": "MITRE ATT&CK - Ingress Tool Transfer (T1105)",
      "url": "https://attack.mitre.org/techniques/T1105/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}