{
  "family": "crysis",
  "sample_count": 24,
  "category": "ransomware",
  "description": "Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emerged in early 2016 following the sunset of TeslaCrypt. Crysis specializes in targeted intrusions against small-to-medium-sized businesses, municipal governments, and healthcare facilities. Rather than relying solely on indiscriminate email spam, Crysis affiliates heavily exploit exposed and weak Remote Desktop Protocol (RDP) credentials (port 3389) via brute-force dictionary attacks. Once gaining initial access, operators manually reconnaissance the victim network, terminate security and backup processes using utility tools like GMER or Process Hacker, execute vssadmin.exe to purge Volume Shadow Copies, and deploy the Crysis executable. Crysis utilizes AES-128 or AES-256 for symmetric file encryption combined with RSA-1024 or RSA-2048 master keys, appending characteristic extensions such as .crysis, .dharma, .wallet, .onion, and .cesar. In November 2016 and May 2017, the original malware authors voluntarily posted master decryption keys to public forums on BleepingComputer, enabling security vendors including Kaspersky and ESET to release universal free decrypters through the global No More Ransom initiative.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Crysis",
    "Dharma",
    "Ransom.Crysis",
    "Trojan-Ransom.Win32.Crusis",
    "W32/Crysis",
    "Ransom.Dharma"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Crysis (Dharma) ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Crysis, later developed into Dharma, is a prolific ransomware family operating under an affiliate model that encrypts local and network storage using strong AES and RSA cryptographic algorithms."
      }
    },
    {
      "@type": "Question",
      "name": "How does Crysis infect victim networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Crysis operators predominantly gain initial access by brute-forcing weakly secured, internet-exposed Remote Desktop Protocol (RDP) servers, followed by manual credential dumping and lateral movement."
      }
    },
    {
      "@type": "Question",
      "name": "Are there free decryption tools available for Crysis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, following the public release of master decryption keys by the authors on BleepingComputer in 2016 and 2017, ESET and Kaspersky published free decrypters through the No More Ransom portal."
      }
    },
    {
      "@type": "Question",
      "name": "What file extensions are associated with Crysis and Dharma?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Crysis encrypted files frequently carry extensions including .crysis, .dharma, .wallet, .onion, .cesar, and .arrow, appended with an attacker contact email address."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations defend against Crysis attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Organizations must disable direct internet-facing RDP ports, enforce multi-factor authentication on remote gateways, maintain immutable offline backups, and restrict administrative command-line utilities."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1078.002",
    "T1562.001",
    "T1021.001",
    "T1047"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "impact"
    },
    {
      "id": "T1078.002",
      "name": "Domain Accounts",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1562.001",
      "name": "Disable or Modify Tools",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1021.001",
      "name": "Remote Desktop Protocol",
      "tactic": "lateral-movement"
    },
    {
      "id": "T1047",
      "name": "Windows Management Instrumentation",
      "tactic": "execution"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2016,
  "lineage": {
    "derived_from": [],
    "variants": [
      "crysis original (.crysis)",
      "dharma (.dharma)",
      "wallet (.wallet)",
      "onion (.onion)",
      "cesar (.cesar)"
    ]
  },
  "attribution": [
    {
      "actor": "Gold Southfield / Dharma Affiliates",
      "confidence": "high"
    },
    {
      "actor": "Russian-speaking Ransomware Operators",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2017-0144",
    "CVE-2017-10271"
  ],
  "c2_profile": {
    "protocols": [
      "TCP",
      "HTTP"
    ],
    "ports": [
      443,
      80,
      3389
    ],
    "traffic_identifiability": "low"
  },
  "iocs": {
    "file_hashes": [
      "2bceba82a4d0cb53930b80985df7ff9f485dbbc0bb394d216bcda3865675fbb3",
      "93bc928f62fa2277d13e9a5c88b0a996df7e20b336a5b6bb98ec2a66e6027f6a"
    ],
    "delivery": [
      "rdp_brute_force",
      "spearphishing_attachment"
    ],
    "persistence": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Startup Folder"
    ]
  },
  "sources": [
    {
      "name": "ESET Research: Crysis Ransomware Technical Analysis and Decryptor",
      "url": "https://www.welivesecurity.com/2016/11/14/eset-releases-decryptor-crysis-ransomware/"
    },
    {
      "name": "No More Ransom Project Crysis Portal",
      "url": "https://www.nomoreransom.org/en/decryption-tools.html"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2017-0144",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0144"
    }
  ],
  "containment_steps": [
    "Immediately disconnect affected hosts from local LAN and remote access tunnels.",
    "Disable exposed public RDP endpoints and reset all local and domain administrator credentials.",
    "Verify whether encrypted files match the Crysis master key database on No More Ransom before considering restoration.",
    "Restore critical data systems from tested, disconnected offline backups."
  ],
  "what_to_avoid": [
    "Never expose port 3389 (RDP) directly to the public internet without an encrypted VPN and MFA.",
    "Do not delete ransomware ransom notes or encrypted sample files required for decryption tool matching.",
    "Never pay extortion demands prior to verifying whether public cryptographic keys decrypt the target files."
  ],
  "target_industries": [
    "healthcare",
    "local_government",
    "manufacturing",
    "small_business"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Dharma Affiliates",
    "Gold Southfield"
  ],
  "target_geographies": [
    "US",
    "DE",
    "GB",
    "IN",
    "BR",
    "AU"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "lateral-movement",
    "impact"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}