{
  "family": "kirts",
  "sample_count": 13,
  "category": "ransomware",
  "description": "Kirts (classified across antimalware research as Ransom:Win32/Kirts and Trojan-Ransom.Win32.Kirts) is a targeted crypto-ransomware family designed to execute destructive file encryption across Windows endpoints and file servers. Propagated through weaponized email attachments and compromised RDP connections, Kirts terminates running office and database processes to clear file locks before encryption. It leverages AES-256 symmetric encryption to lock files and appends .kirts to filenames, placing ransom notes titled HOW_TO_RESTORE_KIRTS.txt in affected directories. To ensure payment compliance, Kirts executes shell commands to purge Volume Shadow Copies via vssadmin and disables Windows startup recovery.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Kirts",
    "Trojan-Ransom.Win32.Kirts",
    "Win32/Kirts",
    "Kirts Ransomware",
    "Ransom.Kirts"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Kirts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kirts is a crypto-ransomware family that encrypts files on Windows workstations and file servers using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kirts clear file locks before encryption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans and terminates processes associated with office productivity suites, database engines, and backup agents."
      }
    },
    {
      "@type": "Question",
      "name": "Does Kirts encrypt mapped network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it discovers and encrypts files on all connected local drives and accessible SMB network shares."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kirts eliminate Volume Shadow Copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet via cmd.exe and disables boot recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "What should organizations do when encountering Kirts ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected endpoints, collect memory dumps and sample binaries, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Kirts from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Kirts persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Kirts attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Kirts modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Kirts dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Kirts",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Kirts"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}