{
  "family": "bodegun",
  "sample_count": 17,
  "category": "ransomware",
  "description": "Bodegun (documented across threat intelligence repositories under signatures including Ransom:Win32/Bodegun, Trojan-Ransom.Win32.Bodegun, and Win32/Bodegun) is a high-impact Windows crypto-ransomware family discovered targeting corporate and small-business file servers. Distributed through weaponized spam attachments, malicious macros, and compromised Remote Desktop Protocol (RDP) sessions, Bodegun executes thorough pre-encryption enumeration to identify local storage drives and mapped SMB shares. It terminates running database services and backup agents using net stop commands, deletes volume shadow copies with 'vssadmin delete shadows /all /quiet', and suppresses system recovery alerts via bcdedit commands. Bodegun encrypts files using AES-256 in CBC mode with session keys protected by an embedded RSA master public key, appending the '.bodegun' extension to locked files, and writes ransom notes ('BODEGUN_README.txt') detailing Tor negotiation instructions.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Bodegun",
    "Trojan-Ransom.Win32.Bodegun",
    "Win32/Bodegun",
    "Ransom.Bodegun",
    "Bodegun Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Bodegun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bodegun is a Windows crypto-ransomware family that encrypts corporate servers and network shares using AES-256 and RSA cryptography."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bodegun prevent shadow copy recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows commands to purge volume shadow copies and bcdedit to suppress automatic boot recovery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bodegun infect corporate networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It infects systems via spear-phishing attachments with weaponized macros, brute-forced RDP connections, and secondary loaders."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted with the .bodegun extension be decrypted for free?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No public decryption tool exists because Bodegun uses standard AES-256 with keys protected by an asymmetric RSA public key."
      }
    },
    {
      "@type": "Question",
      "name": "What immediate response actions should be taken upon detecting Bodegun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate affected endpoints from the network immediately, preserve forensic memory images, and restore data from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1489",
    "T1083",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Macro Documents",
    "Compromised Remote Desktop Protocol (RDP)",
    "Secondary Malware Loaders"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows Server 2016"
  ],
  "capabilities": [
    "Hybrid Cryptography (AES-256-CBC + RSA)",
    "Volume Shadow Copy & Boot Recovery Deletion",
    "Database & Hypervisor Service Termination",
    "Network Share Traversal & Lateral Encryption",
    "Automated Ransom Note Placement"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Win64 PE Executable"
    ],
    "network_signatures": [
      "Outbound connections to Tor proxy bridges or anonymous negotiation portals",
      "SMB network scanning traffic mapping open administrative shares"
    ],
    "evasion_techniques": [
      "Terminating security software processes to prevent behavioral blocking",
      "Dynamic API resolution to hide cryptographic and file traversal functions"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f",
      "4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BodegunLocker"
    ],
    "file_paths": [
      "%AppData%\\Bodegun\\bodegun.exe",
      "C:\\BODEGUN_README.txt"
    ]
  },
  "defensive_measures": [
    "Maintain immutable, air-gapped backups to ensure business continuity without paying ransoms",
    "Enforce strict multi-factor authentication on all external-facing remote access endpoints",
    "Deploy endpoint detection and response (EDR) rules detecting anomalous bulk file modifications"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Bodegun",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Bodegun"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Bodegun",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Bodegun.A",
      "Ransom:Win32/Bodegun.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Corporate Ransom Demands",
  "sample_hashes": []
}