{
  "family": "kraddare",
  "sample_count": 13,
  "category": "ransomware",
  "description": "Kraddare (classified as Ransom:Win32/Kraddare across Microsoft Defender, Kaspersky, and Trend Micro) is an enterprise crypto-ransomware family designed for rapid data extortion. Distributed via phishing attachments and malicious drive-by downloads, Kraddare terminates active database processes and email servers to avoid file-locking conflicts. It executes a multi-threaded encryption routine that leverages AES-256 in CBC mode, prepending unique file headers and renaming encrypted files with the .kraddare extension. Kraddare leaves ransom notes titled RESTORE_KRADDARE_FILES.html on the desktop and within every processed directory, demanding cryptocurrency payment for file restoration while wiping Volume Shadow Copies and system restore points.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Kraddare",
    "Trojan-Ransom.Win32.Kraddare",
    "Win32/Kraddare",
    "Kraddare Ransomware",
    "Ransom.Kraddare"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Kraddare?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kraddare is an enterprise crypto-ransomware family that encrypts corporate workstations and network shares using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Kraddare terminate database processes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminating database and mail services unlocks open file handles, allowing Kraddare to encrypt live databases."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kraddare target network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enumerates local network interfaces and Server Message Block (SMB) connections, encrypting shared departmental files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kraddare prevent system recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and clears Windows recovery options via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended response plan for Kraddare victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect infected machines from the local network, preserve encrypted files for future decryptor availability, and restore from backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Kraddare from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Kraddare persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Kraddare attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Kraddare modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Kraddare dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Kraddare",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Kraddare"
    },
    {
      "name": "Sophos Threat Center - Ransom_Kraddare Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Ransom-Kraddare"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}