{
  "family": "golroted",
  "sample_count": 21,
  "category": "ransomware",
  "description": "Golroted (classified across antimalware engines under designations including Ransom:Win32/Golroted, Trojan-Ransom.Win32.Golroted, and Win32/Golroted) is a destructive crypto-ransomware family designed to lock enterprise and consumer Windows hosts. Propagated through malvertising redirects, phishing campaigns, and exploit kit droppers, Golroted terminates database processes, email services, and hypervisor components to ensure unhindered file access. It sweeps all available fixed, removable, and mapped network drives, encrypting critical business documents, databases, archives, and spreadsheets using AES-256 encryption wrapped with an asymmetric public key. Golroted executes vssadmin commands to purge Volume Shadow Copies, alters desktop wallpaper to display extortion demands, and deposits text ransom notes demanding cryptocurrency payments.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Golroted",
    "Trojan-Ransom.Win32.Golroted",
    "Win32/Golroted",
    "Ransom.Golroted",
    "Ransom:Win32/Golroted.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Golroted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Golroted is a crypto-ransomware family that encrypts Windows data with AES-256 and demands cryptocurrency ransom for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Golroted destroy local recovery options?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet to purge all Volume Shadow Copies."
      }
    },
    {
      "@type": "Question",
      "name": "What storage locations are targeted by Golroted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets local fixed hard drives, external USB drives, and connected network file shares."
      }
    },
    {
      "@type": "Question",
      "name": "How is Golroted delivered to victim computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious malvertising redirects, phishing attachments, and exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended recovery response for Golroted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the network, remove ransomware executables, and restore encrypted data from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Golroted",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Golroted"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Golroted",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_golroted"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Golroted",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Golroted"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from network connections immediately to halt encryption across shared network drives.",
    "Kill active ransomware processes via Windows Task Manager or elevated PowerShell commands.",
    "Preserve forensic memory dumps and sample files for threat intelligence and hash matching.",
    "Block delivery vectors including malicious URLs and sender email domains.",
    "Restore encrypted files from air-gapped, immutable backup archives."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency ransom demand; it funds illicit cybercrime activities without guarantee of recovery.",
    "Do not reboot systems before securing volatile memory data."
  ],
  "target_industries": [
    "Healthcare",
    "Manufacturing",
    "Retail",
    "Commercial Businesses"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}