{
  "family": "czyk",
  "sample_count": 32,
  "category": "trojan",
  "description": "Czyk (cataloged across endpoint protection engines and telemetry as Trojan:Win32/Czyk, Ransom:Win32/Czyk, and Trojan.Czyk) is a modular Windows trojan loader and extortion threat active since 2016. Often distributed through spam emails carrying weaponized archive attachments or deceptive software cracks, Czyk executes an obfuscated initial stager that conducts host reconnaissance before establishing encrypted command-and-control communication. Depending on operator instructions and victim profiling, Czyk can deploy secondary ransomware payloads to encrypt user files with AES/RSA encryption, display lockscreen ransom demands, or install persistent backdoor components into system directories to facilitate long-term unauthorized access.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Czyk",
    "Ransom:Win32/Czyk",
    "Trojan.Czyk",
    "Win32/Czyk",
    "Trojan:Win32/Czyk.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Czyk?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Czyk is a Windows trojan downloader and stager that can deliver secondary ransomware and backdoor components to infected endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "How does Czyk evade detection on infected endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for virtualized environments (VMware, VirtualBox), resolves APIs dynamically, and injects code into legitimate Windows processes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Czyk achieve persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes startup keys under the Windows CurrentVersion\\Run registry branch and creates scheduled maintenance tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How does Czyk communicate with its operators?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It issues encrypted HTTP POST requests carrying base64-encoded system telemetry and retrieves secondary payloads masked as data files."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken if Czyk is detected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate suspicious injected processes, delete persistence registry keys, and run a complete malware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1071.001",
    "T1486",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "P2P Software Cracks & Keygens",
    "Compromised Web Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted HTTP C2 Beaconing",
    "Process Injection into svchost.exe",
    "Secondary Ransomware Deployment",
    "Host Hardware Reconnaissance",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST requests carrying base64-encoded and XOR-encrypted host GUIDs and environment details",
      "Direct downloads of secondary stage binary payloads masquerading as temporary data files"
    ],
    "evasion_techniques": [
      "Checking for virtualized environment artifacts (VMware, VirtualBox, QEMU) before unpacking payloads",
      "Dynamic API resolution to hide malicious Win32 API calls from static detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c",
      "a0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CzykAgent",
      "HKCU\\Software\\Czyk"
    ],
    "file_paths": [
      "%AppData%\\Czyk\\czyk.exe",
      "%Temp%\\cz_payload.bin",
      "%ProgramData%\\Czyk\\config.dat"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint behavioral monitoring to detect process hollowing into svchost.exe",
    "Block execution of unverified binaries from temporary and roaming user directories",
    "Inspect perimeter web traffic for anomalous periodic encrypted POST beacons"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Czyk",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Czyk"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Czyk",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Czyk.A",
      "Ransom:Win32/Czyk.B"
    ]
  },
  "motivation": "Initial Compromise, Secondary Payload Staging & Ransom Extortion",
  "sample_hashes": []
}