{
  "family": "kolovorot",
  "sample_count": 18,
  "category": "ransomware",
  "description": "Kolovorot (documented across security intelligence reports under signatures including Ransom:Win32/Kolovorot, Trojan-Ransom.Win32.Kolovorot, and Ransom.Kolovorot) is an aggressive and destructive Windows ransomware and disk-locking threat. Delivered through weaponized email attachments and software cracking archives, Kolovorot attempts to overwrite the Master Boot Record (MBR) and partition table of the primary hard drive (PhysicalDrive0) in addition to encrypting user files. It invokes low-level disk access via CreateFileW with raw device handles ('\\\\.\\PhysicalDrive0'), replacing the bootloader code with custom screen-locking assembly code that demands cryptocurrency ransom before the operating system can boot. For accessible user files, it uses symmetric AES-256 encryption and appends '.kolovorot', dropping ransom notes ('KOLOVOROT_LOCK.txt') instructing victims on payment.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Kolovorot",
    "Trojan-Ransom.Win32.Kolovorot",
    "Win32/Kolovorot",
    "Ransom.Kolovorot",
    "Kolovorot MBR Locker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Kolovorot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kolovorot is a destructive Windows ransomware family that overwrites the Master Boot Record (MBR) and encrypts user files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kolovorot hijack system boot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It opens raw handles to PhysicalDrive0 using CreateFileW and overwrites the first sector (MBR) with a custom bootloader screen locker."
      }
    },
    {
      "@type": "Question",
      "name": "How is Kolovorot distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed via malicious email attachments, Trojanized crack utilities, and deceptive download portals."
      }
    },
    {
      "@type": "Question",
      "name": "Can an infected computer boot into Windows after a Kolovorot infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, upon reboot the custom MBR displays a ransom note in 16-bit real mode before Windows can initialize."
      }
    },
    {
      "@type": "Question",
      "name": "How can system administrators recover an endpoint infected by Kolovorot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot from a Windows recovery USB, rebuild the MBR using bootrec /fixmbr and bootrec /fixboot, and restore encrypted files from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1561.002",
    "T1490",
    "T1083",
    "T1489"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Trojanized Software Cracks and Keygens",
    "Deceptive Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Master Boot Record (MBR) Overwriting",
    "Pre-Boot Real-Mode Ransom Screen Display",
    "Symmetric File Encryption (AES-256)",
    "Shadow Copy & System Backup Deletion",
    "Automated Ransom Note Placement"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "16-bit MBR Assembly Shellcode"
    ],
    "network_signatures": [
      "Outbound HTTP requests transmitting victim infection identifiers",
      "Connections to Tor negotiation proxy gateways"
    ],
    "evasion_techniques": [
      "Direct raw disk handle acquisition to bypass user-mode file system filters",
      "Immediate forced system reboot via ExitWindowsEx to activate the MBR lock screen"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c",
      "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\KolovorotLocker"
    ],
    "file_paths": [
      "%AppData%\\Kolovorot\\kolovorot.exe",
      "C:\\KOLOVOROT_LOCK.txt"
    ]
  },
  "defensive_measures": [
    "Enable UEFI Secure Boot and BitLocker device encryption to protect MBR/boot sector integrity",
    "Maintain immutable, air-gapped backups to ensure complete recovery without ransom payment",
    "Deploy endpoint security policies that block low-level raw disk write operations from user processes"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Kolovorot",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Kolovorot"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Kolovorot",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Kolovorot.A",
      "Ransom:Win32/Kolovorot.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe",
    "mbr"
  ],
  "is_emerging": false,
  "motivation": "Destructive Impact & Financial Extortion",
  "sample_hashes": []
}