{
  "family": "genericrxdz",
  "sample_count": 14,
  "category": "ransomware",
  "description": "GenericRXDZ (classified across commercial antivirus engines under designations including Ransom:Win32/GenericRXDZ and Trojan-Ransom.Win32.GenericRXDZ) is an evasive crypto-ransomware family designed for targeted extortion attacks against Windows enterprise environments. Infiltrating endpoints via exploit kits, malicious downloads, and lateral movement tools, GenericRXDZ terminates local database processes and security software to clear file handles before launching its cryptographic routines. It scans local fixed drives, removable USB storage, and mapped SMB network shares, encrypting high-value business documents, spreadsheets, databases, and backup archives with AES-256. It leaves ransom notes in every affected folder and wipes Volume Shadow Copies via administrative shell commands.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/GenericRXDZ",
    "Trojan-Ransom.Win32.GenericRXDZ",
    "Win32/GenericRXDZ",
    "GenericRXDZ Ransomware",
    "Ransom.GenericRXDZ"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/GenericRXDZ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "GenericRXDZ is an enterprise ransomware family that encrypts files on Windows endpoints using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "How does GenericRXDZ target network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enumerates local network interfaces and Server Message Block (SMB) connections, encrypting shared files."
      }
    },
    {
      "@type": "Question",
      "name": "How does GenericRXDZ prevent local recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and disables automatic startup recovery via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are targeted by GenericRXDZ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets business documents, spreadsheets, databases, media files, and compressed backup archives."
      }
    },
    {
      "@type": "Question",
      "name": "What should security teams do upon encountering GenericRXDZ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate infected machines, preserve encrypted samples and notes, and restore systems from clean backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Genericrxdz from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Genericrxdz persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Genericrxdz attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Genericrxdz modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Genericrxdz dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/GenericRXDZ",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/GenericRXDZ"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}