{
  "family": "krucky",
  "sample_count": 22,
  "category": "ransomware",
  "description": "Krucky (tracked in malware research telemetry under designations including Ransom:Win32/Krucky, Ransom:Win32/Krucky.A, and Trojan-Ransom.Win32.Krucky) is a destructive crypto-ransomware family targeting Windows endpoints. Operating in opportunistic extortion campaigns, Krucky infiltrates target networks via malicious email campaigns containing obfuscated JavaScript or VBScript droppers and through compromised software cracks. Upon execution, Krucky terminates security processes and database engines using taskkill. It searches mounted fixed disks, removable drives, and accessible network SMB shares, encrypting documents, spreadsheets, SQL databases, and archives using AES-256 encryption with an embedded RSA public key. Krucky disables system recovery by executing vssadmin to delete Volume Shadow Copies and uses bcdedit to disable automatic Windows startup recovery. It leaves text ransom notes in every traversed directory instructing victims on Bitcoin extortion demands.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Krucky",
    "Ransom:Win32/Krucky.A",
    "Trojan-Ransom.Win32.Krucky",
    "Win32/Krucky",
    "Ransom.Krucky"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Krucky?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Krucky is a crypto-ransomware family that encrypts Windows data with AES-256 and demands cryptocurrency payment for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Krucky destroy local backup copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs vssadmin to delete all Volume Shadow Copies and modifies bcdedit settings to disable startup recovery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Krucky infect enterprise workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via spam emails containing malicious scripts, weaponized macros, and cracked software packages."
      }
    },
    {
      "@type": "Question",
      "name": "What types of files are encrypted by Krucky?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It encrypts spreadsheets, documents, SQL databases, archives, virtual machine disks, and media files."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended response to a Krucky attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate affected machines from the network immediately, terminate active processes, and recover data from secure offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Krucky",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Krucky"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Krucky",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_krucky"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Krucky",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Krucky"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from all physical and wireless network interfaces to halt encryption.",
    "Kill active ransomware processes using Task Manager or command-line commands.",
    "Preserve system memory dumps and sample files for threat intelligence and forensics.",
    "Block malicious sender domains and network indicators at border firewalls.",
    "Rebuild infected machines and restore files from verified offline backups."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency ransom demand; it funds illicit cybercrime activities without guarantee of recovery.",
    "Do not connect clean backup drives to machines before verifying they are thoroughly remediated."
  ],
  "target_industries": [
    "Healthcare",
    "Small and Medium Businesses",
    "Manufacturing",
    "Retail"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}