{
  "family": "enigma",
  "sample_count": 14,
  "category": "ransomware",
  "description": "Enigma (classified as Ransom:Win32/Enigma and Trojan-Ransom.Win32.Enigma) is an advanced Windows crypto-ransomware family designed for rapid and devastating corporate extortion. Distributed through malicious email spam containing weaponized HTML attachments and compromised RDP connections, Enigma initiates execution by checking system language and locale settings to avoid infecting Commonwealth of Independent States (CIS) endpoints. It uses strong symmetric encryption (AES-128 in CBC mode or ChaCha20) combined with an embedded RSA public key to encrypt user files, appending .enigma to encrypted files. It generates comprehensive HTML ransom notes (enigma.html), deletes Volume Shadow Copies with vssadmin, and directs victims to a Tor negotiation portal.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Enigma",
    "Trojan-Ransom.Win32.Enigma",
    "Win32/Enigma",
    "Enigma Ransomware",
    "Ransom.Enigma"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Enigma?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enigma is a crypto-ransomware family that encrypts corporate files using AES and RSA, demanding ransom payments via Tor."
      }
    },
    {
      "@type": "Question",
      "name": "What locale checks does Enigma perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks keyboard layouts and system UI languages, terminating immediately if CIS language codes (such as Russian) are detected."
      }
    },
    {
      "@type": "Question",
      "name": "How does Enigma deliver its initial payload?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via spear-phishing emails containing malicious HTML attachments that use HTML smuggling to drop the executable."
      }
    },
    {
      "@type": "Question",
      "name": "How does Enigma defeat shadow copy recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and clears recovery catalog data via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended response to an Enigma attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate infected workstations, preserve memory dumps and ransom notes, block outbound Tor traffic, and restore from backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1614.001",
    "T1027.006",
    "T1083",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1620",
      "name": "Reflective Code Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (Typical Payload)",
      "tactic": "Impact"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the successful execution of an Enigma-packed file usually results in an active ransomware or trojan infection.",
    "Capture a live memory image (RAM dump); this is often the only way to recover the unencrypted payload for reverse engineering and IoC extraction.",
    "Utilize EDR telemetry to trace the origin of the packed executable to identify the initial infection vector (e.g., a phishing email or drive-by download).",
    "Do not rely on standard AV scans to clean the machine, as the unpacked payload may have established secondary persistence mechanisms."
  ],
  "what_to_avoid": [
    "Avoid assuming an executable is safe just because it passes a static antivirus scan; heavily packed files are designed specifically to bypass these checks.",
    "Do not attempt to manually reverse engineer the Enigma stub without specialized unpacking tools; commercial protectors are highly complex and time-consuming to defeat."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Enigma",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Enigma"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom.Win32.Enigma",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Enigma/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}