{
  "family": "dico",
  "sample_count": 16,
  "category": "ransomware",
  "description": "Dico (classified across antimalware research as Ransom:Win32/Dico, Trojan-Ransom.Win32.Dico, and Ransom.Dico) is a high-impact corporate crypto-ransomware family designed for rapid and thorough enterprise extortion campaigns. Typically deployed in human-operated intrusions following initial access gained via stolen remote access credentials or phishing loaders, Dico prioritizes high-value corporate servers and storage arrays. Upon execution with elevated administrator or SYSTEM privileges, Dico initiates environmental reconnaissance, verifying domain controller connectivity and enumerating active Active Directory network resources. The ransomware uses an AES-256-CBC symmetric cipher combined with an embedded RSA-2048 public master key to encrypt documents, financial spreadsheets, databases, CAD designs, and backup archives. Encrypted files are renamed with a unique extension, and ransom notes titled `README_RESTORE_FILES.txt` are created in every folder. Dico deletes Volume Shadow Copies, clears Windows security and system event logs via wevtutil, and instructs victims to negotiate extortion payment exclusively through Tor.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Dico",
    "Trojan-Ransom.Win32.Dico",
    "Win32/Dico",
    "Dico Ransomware",
    "Ransom.Dico"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Dico?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dico is an enterprise crypto-ransomware family that encrypts corporate servers and workstations using AES-256 and RSA-2048."
      }
    },
    {
      "@type": "Question",
      "name": "How do threat actors deploy Dico across corporate networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They use compromised administrative credentials via PsExec, WMI, or Group Policy Objects (GPO) to distribute Dico to multiple hosts."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dico hinder incident response analysis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes wevtutil commands to clear Windows Application, Security, and System event logs, wiping forensic telemetry."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted by Dico be recovered without paying the ransom?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Without the attacker's private RSA key, recovery requires restoring data from isolated, unencrypted offline backups."
      }
    },
    {
      "@type": "Question",
      "name": "What security measures mitigate Dico ransomware threats?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce strict network segmentation, restrict lateral movement tools (PsExec, WMI), mandate MFA, and maintain air-gapped backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1070.001",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Dico from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Dico persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Dico attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Dico modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Dico dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Dico",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Dico"
    },
    {
      "name": "Sophos Threat Center - Ransom_Dico Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Ransom-Dico"
    },
    {
      "name": "MITRE ATT&CK - Indicator Removal: Clear Windows Event Logs (T1070.001)",
      "url": "https://attack.mitre.org/techniques/T1070/001/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}