{
  "family": "generickdz",
  "sample_count": 15,
  "category": "ransomware",
  "description": "GenericKDZ (classified across endpoint antimalware engines under designations including Ransom:Win32/GenericKDZ, Trojan-Ransom.Win32.GenericKDZ, and Win32/GenericKDZ) is a destructive crypto-ransomware family designed for automated file locking on Windows endpoints. Delivered via malicious email links, compromised software installers, and drive-by download vectors, GenericKDZ verifies privilege elevation and immediately surveys mounted drive letters, network shares, and removable media. It targets user productivity files, databases, and backup archives with AES-256 encryption. Encrypted files are appended with unique identifier tags, and extortion instructions are placed in every directory instructing victims to contact the attackers via Tor or encrypted email. It deletes Volume Shadow Copies via vssadmin and disables recovery modes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/GenericKDZ",
    "Trojan-Ransom.Win32.GenericKDZ",
    "Win32/GenericKDZ",
    "GenericKDZ Ransomware",
    "Ransom.GenericKDZ"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/GenericKDZ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "GenericKDZ is a crypto-ransomware family that encrypts files on Windows computers using AES-256 and demands ransom payment."
      }
    },
    {
      "@type": "Question",
      "name": "How does GenericKDZ target network resources?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enumerates mapped network drives and SMB shares, recursively encrypting shared enterprise documents."
      }
    },
    {
      "@type": "Question",
      "name": "How does GenericKDZ prevent local file restoration?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to delete Volume Shadow Copies and uses bcdedit to disable automatic recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are targeted by GenericKDZ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets business documents, spreadsheets, databases, media files, and compressed backup archives."
      }
    },
    {
      "@type": "Question",
      "name": "How should IT teams respond to a GenericKDZ alert?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the compromised system from the network, capture forensic artifacts, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Generickdz from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Generickdz persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Generickdz attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Generickdz modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Generickdz dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/GenericKDZ",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/GenericKDZ"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}