{
  "family": "birele",
  "sample_count": 16,
  "category": "ransomware",
  "description": "Birele (classified across commercial antivirus and EDR solutions under designations including Ransom:Win32/Birele, Trojan-Ransom.Win32.Birele, and Ransom.Birele) is a targeted crypto-ransomware family designed to execute destructive file encryption against Windows endpoints and corporate network storage. Distributed through targeted phishing emails, exposed Remote Desktop Protocol (RDP) brute-force compromises, and malicious loader frameworks, Birele prioritizes speed and evasion during its attack lifecycle. Upon initial execution, it queries local logical drives and enumerates Server Message Block (SMB) network shares to compile an extensive target inventory. Birele employs a hybrid cryptographic scheme combining AES-256 in CBC mode for bulk data encryption with an embedded RSA public master key to lock per-file encryption keys. It appends custom file extensions to encrypted documents, databases, archives, and system images, leaving ransom notes detailing extortion demands and communication channels. To maximize recovery difficulty, Birele executes commands via cmd.exe to delete Volume Shadow Copies (`vssadmin delete shadows /all /quiet`) and disable Windows Startup Recovery.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Birele",
    "Trojan-Ransom.Win32.Birele",
    "Win32/Birele",
    "Birele Ransomware",
    "Ransom.Birele"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Birele?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Birele is a corporate-targeting crypto-ransomware family that encrypts files on local storage and network shares using AES-256 and RSA."
      }
    },
    {
      "@type": "Question",
      "name": "What encryption algorithms does Birele ransomware use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses symmetric AES-256 for rapid file stream encryption and an embedded RSA master public key to secure file keys."
      }
    },
    {
      "@type": "Question",
      "name": "Does Birele encrypt mapped network drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. Birele actively enumerates local drives and accessible SMB network shares to encrypt centralized enterprise storage."
      }
    },
    {
      "@type": "Question",
      "name": "How does Birele prevent system restore?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It invokes vssadmin to delete all Volume Shadow Copies and uses bcdedit to disable automatic Windows startup repair."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended response to a Birele ransomware attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately isolate infected endpoints, preserve encrypted samples and ransom notes for key recovery analysis, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Birele from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Birele persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Birele attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Birele modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Birele dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Birele",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Birele"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom.Win32 Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}