{
  "family": "blamon",
  "sample_count": 22,
  "category": "ransomware",
  "description": "Blamon (tracked across endpoint security telemetry under signatures Ransom:Win32/Blamon, Ransom:Win32/Blamon.A, and Trojan-Ransom.Win32.Blamon) is a destructive crypto-ransomware family designed to lock local and network-attached storage on Windows systems. Infiltrating environments primarily through malicious email campaigns featuring weaponized macros or archive files, Blamon initiates execution by verifying administrative privileges and conducting host discovery. It terminates database management engines, mail servers, and backup utilities to release file access locks. Blamon encrypts user documents, databases, archives, and multimedia files using AES-256 encryption wrapped with an embedded RSA public key, appending a distinctive extension such as .blamon to encrypted files. It executes vssadmin delete shadows /all /quiet and wbadmin delete catalog -quiet to destroy Volume Shadow Copies and system state backups, before dropping extortion notes demanding cryptocurrency payment for file restoration.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Blamon",
    "Ransom:Win32/Blamon.A",
    "Trojan-Ransom.Win32.Blamon",
    "Win32/Blamon",
    "Ransom.Blamon"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Blamon?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Blamon is a crypto-ransomware family targeting Windows devices, encrypting user and enterprise files with AES-256 and demanding cryptocurrency ransom."
      }
    },
    {
      "@type": "Question",
      "name": "How does Blamon inhibit system recovery options?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to silently delete all Volume Shadow Copies and uses wbadmin to invalidate backup catalogs."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are encrypted by Blamon?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets office documents, spreadsheets, databases, system backups, source code files, and virtual machine images."
      }
    },
    {
      "@type": "Question",
      "name": "How is Blamon ransomware distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed through phishing email attachments containing weaponized macros, malicious downloaders, and exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise respond to a Blamon ransomware infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the compromised system immediately, capture volatile memory artifacts, remove malicious binaries, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Blamon",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Blamon"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Blamon",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_blamon"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Blamon",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Blamon"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately sever network and Wi-Fi connections to prevent ransomware spread to network shares.",
    "Terminate active encryption processes using Windows Task Manager or command-line tools.",
    "Identify and block malicious sender email addresses and payload delivery domains.",
    "Capture memory forensics and file samples for incident response and threat intelligence telemetry.",
    "Reimage compromised endpoints and restore business data from validated, immutable backups."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency extortion fee, as it does not guarantee key delivery and finances further attacks.",
    "Do not reboot affected systems before capturing volatile forensic memory artifacts."
  ],
  "target_industries": [
    "Healthcare",
    "Manufacturing",
    "Financial Institutions",
    "Commercial Enterprises"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Cybercriminal Syndicates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}