{
  "family": "crusis",
  "sample_count": 19,
  "category": "ransomware",
  "description": "Crusis (widely known in the cybersecurity community as the CrySiS or Dharma ransomware family and cataloged by Microsoft as Ransom:Win32/Crusis) is an infamous targeted ransomware threat active since 2016. Attacking corporate networks primarily by brute-forcing weakly configured Remote Desktop Protocol (RDP) connections and exploiting vulnerable internet-exposed remote management services, Crusis operators manually execute intrusion operations. Once inside a network, operators deploy administrative tools, terminate database and backup software, and execute Crusis. The ransomware encrypts targeted files across fixed, removable, and network-mapped drives using AES-256 and RSA-1024 encryption, renaming files with dynamic extensions (such as .crusis, .dharma, or .wallet) alongside the attacker's contact email address. Crusis purges Volume Shadow Copies using vssadmin and leaves extortion notes instructing victims on Bitcoin payments.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Crusis",
    "Trojan-Ransom.Win32.Crusis",
    "CrySiS",
    "Dharma",
    "Ransom:Win32/Crusis.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Crusis (CrySiS / Dharma)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Crusis is a prominent targeted ransomware family (also known as CrySiS or Dharma) that infiltrates networks via compromised RDP ports."
      }
    },
    {
      "@type": "Question",
      "name": "How does Crusis gain access to enterprise networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operators gain access primarily through brute-forcing exposed Remote Desktop Protocol (RDP) ports and using stolen credentials."
      }
    },
    {
      "@type": "Question",
      "name": "What encryption methods does Crusis utilize?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses a hybrid scheme of AES-256 for symmetric file encryption and RSA for public key protection."
      }
    },
    {
      "@type": "Question",
      "name": "How does Crusis eliminate local recovery options?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and terminates database and backup service processes."
      }
    },
    {
      "@type": "Question",
      "name": "What are the most effective defenses against Crusis / Dharma?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disable internet-facing RDP, enforce multi-factor authentication, apply account lockout policies, and maintain offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1133",
    "T1486",
    "T1490",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Crusis",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Crusis"
    },
    {
      "name": "CISA Cybersecurity Advisory - CrySiS/Dharma Ransomware Analysis",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Crysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_crysis"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1133",
      "name": "External Remote Services",
      "tactic": "Initial Access"
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately disable internet-exposed RDP access and isolate infected network segments.",
    "Kill active Crusis processes and batch scripts using Task Manager or PowerShell.",
    "Capture memory forensics from infected domain controllers and file servers before rebooting.",
    "Audit Active Directory user accounts for newly created unauthorized administrative profiles.",
    "Restore encrypted files from verified, air-gapped offline backups."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency extortion demand; payment fuels future attacks and key recovery is never assured.",
    "Do not leave default RDP port 3389 exposed to the public internet without VPN and MFA safeguards."
  ],
  "target_industries": [
    "Healthcare",
    "Small and Medium Businesses",
    "Manufacturing",
    "Local Government"
  ],
  "target_geographies": [
    "Global",
    "North America",
    "Europe"
  ],
  "threat_actors": [
    "Dharma / CrySiS Ransomware Operators"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Targeted Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}