{
  "family": "fakefolder",
  "sample_count": 7,
  "category": "ransomware",
  "description": "Trojan:Win32/Fakefolder (or generic **Folder Icon Spoofing** heuristics) represents a classic, yet highly effective social engineering tactic utilized primarily by USB worms and specific trojans. The malware deliberately changes its executable icon to match the standard yellow Windows Folder icon and hides the actual legitimate directories. The goal is to trick a user into double-clicking what they believe is a folder, which instead executes the malicious payload.<br><br><b>Understanding Fakefolder Tactics</b><br>To an end-user, this attack is highly deceptive. They plug in a USB drive, see a folder named 'Documents' with the correct icon, and double-click it. For a security analyst, this represents a reliance on user deception (`T1036.004`) rather than complex exploits. While the delivery mechanism is simple, the payloads hidden behind the fake folder icon can range from massive botnets to severe ransomware.<br><br><b>Execution and Deception Mechanics</b><br>Fakefolder malware typically spreads via removable media (USB drives) (`T1091`) or network shares (`T1080`). Upon infecting a drive, the malware marks all existing legitimate folders as 'Hidden' and 'System' files (`T1564.001`), making them invisible to the default Windows Explorer view. It then copies its own malicious executable (`.exe`, `.vbs`, or `.scr`) to the root of the drive, renaming itself to match the names of the hidden folders. Crucially, it embeds the standard `shell32.dll` folder icon into its executable (`T1036.004`). When the victim double-clicks the 'folder' (`T1204.002`), the malware executes. To maintain the illusion, the malware will often simultaneously open a new Explorer window displaying the contents of the *actual* hidden folder, so the user never realizes they just ran an executable.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the execution of a secondary payload (often a worm that will continue to spread). The most glaring host-based IoC is the presence of executables (`.exe`) that share the exact names of directories on a USB drive or network share. A sudden spike in EDR alerts originating from executions on removable media (`D:\\`, `E:\\`) is a strong indicator of a Fakefolder worm outbreak.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Fakefolder and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakefolder is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fakefolder establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakefolder typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Fakefolder compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Fakefolder should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Fakefolder employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakefolder typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Fakefolder, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Fakefolder depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1564.001",
    "T1091",
    "T1036.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1036.004",
      "name": "Masquerading: Masquerade Task or Service (Spoofing the folder icon)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1564.001",
      "name": "Hide Artifacts: Hidden Files and Directories (Hiding the real folders)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (USB worm propagation)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instruct users to enable 'File name extensions' and 'Hidden items' in the Windows Explorer View tab; this instantly reveals the deception (e.g., 'Documents' becomes 'Documents.exe').",
    "Disable AutoRun and AutoPlay enterprise-wide via Group Policy for all removable media.",
    "Use EDR to track the execution chain; if a user executed a Fakefolder payload, you must identify what secondary malware it dropped on the system.",
    "Sanitize infected USB drives using the command prompt (`attrib -h -r -s /s /d drive_letter:\\*.*`) to unhide the legitimate folders, then delete the malicious executables."
  ],
  "what_to_avoid": [
    "Do not instruct users to simply format infected USB drives; their legitimate files are still there, they are just hidden by the malware.",
    "Avoid assuming this is a low-level threat; while the propagation method is old, the payload hidden behind the folder icon could be modern ransomware."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}