{
  "family": "macri",
  "sample_count": 13,
  "category": "ransomware",
  "description": "Macri (classified in threat databases as Ransom:Win32/Macri and Trojan-Ransom.Win32.Macri) is a targeted corporate crypto-ransomware family that encrypts files on local storage and network shares. Once executed, Macri interrogates the host environment for active debuggers and virtualization hypervisors before deploying its encryption routine. It scans all local fixed disks, removable media, and mapped network drives, identifying high-value files based on an extensive extension list covering documents, databases, spreadsheets, source code, and media archives. It locks targets using AES-256 encryption, appending .macri to filenames and dropping ransom notes titled READ_MACRI_DECRYPT.txt. Macri executes administrative shell commands to delete Volume Shadow Copies and disable startup repair.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Macri",
    "Trojan-Ransom.Win32.Macri",
    "Win32/Macri",
    "Macri Ransomware",
    "Ransom.Macri"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Macri?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Macri is an enterprise crypto-ransomware family that encrypts corporate files across local and network storage using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "What evasion checks does Macri perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It interrogates debugging APIs and verifies the absence of virtualization hypervisors before executing."
      }
    },
    {
      "@type": "Question",
      "name": "Does Macri encrypt network file shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it aggressively enumerates active SMB network shares and encrypts accessible shared folders."
      }
    },
    {
      "@type": "Question",
      "name": "How does Macri prevent local recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and disables automatic startup recovery via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "How should IT teams respond to a Macri incident?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect affected systems from the corporate LAN, preserve encrypted samples and notes, and restore from immutable backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1497.001",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Macri from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Macri persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Macri attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Macri modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Macri dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Macri",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Macri"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}