{
  "family": "nakoctb",
  "sample_count": 134,
  "category": "ransomware",
  "description": "Ransom:Win32/Nakoctb (frequently cataloged in security telemetry as naKocTb, Trojan:Win32/Nakoctb, or Trojan-Ransom.Win32.Nakoctb) is a notorious Windows screenlocker and extortion ransomware family named after the Russian term for 'nuisance' or 'malicious harm' (пакость). Rather than relying on cryptographic file encryption, classic Nakoctb variants hijack the desktop interface by disabling critical administrative utilities—including Task Manager (taskmgr.exe), the Registry Editor (regedit.exe), and the Windows shell (explorer.exe). The ransomware presents an un-dismissible, full-screen extortion window that blocks user access to the desktop, falsely alleging illicit activity or copyright infringement and demanding ransom payment via premium SMS, digital vouchers, or cryptocurrency to provide an unlocking code. Modern strains also feature secondary downloader capabilities to fetch additional crimeware payloads.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Nakoctb",
    "naKocTb",
    "Ransom:Win32/Nakoctb",
    "Trojan:Win32/Nakoctb",
    "Trojan-Ransom.Win32.Nakoctb",
    "Win32/Nakoctb",
    "Nakoctb Winlocker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Nakoctb (naKocTb) ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nakoctb is a Windows screenlocker and extortion ransomware family that locks the computer screen and demands ransom payment to restore desktop access."
      }
    },
    {
      "@type": "Question",
      "name": "Does Nakoctb encrypt victim files on disk?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Traditional Nakoctb variants act as Winlockers that restrict system access and disable system utilities rather than encrypting individual user files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Nakoctb prevent users from closing the ransom screen?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The malware disables Task Manager and Registry Editor via registry policies (DisableTaskMgr, DisableRegistryTools) and sets its window as topmost."
      }
    },
    {
      "@type": "Question",
      "name": "How is Nakoctb distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nakoctb is commonly distributed via malicious spam email attachments, malicious adult site downloads, and trojanized software cracks."
      }
    },
    {
      "@type": "Question",
      "name": "How can a Nakoctb screenlocker infection be removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Infections can be resolved by booting into Safe Mode or using Windows PE / offline antivirus rescue disks to remove the persistence registry keys and malicious executables."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1489",
    "T1562.001",
    "T1059.003",
    "T1547.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Nakoctb from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Nakoctb persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Nakoctb attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Nakoctb modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Nakoctb dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "actor": "Eastern European Cybercrime Extortionists",
  "cve": [
    "CVE-2012-0158",
    "CVE-2017-11882"
  ],
  "d3fend": [
    "D3-AM",
    "D3-EDR",
    "D3-FIM",
    "D3-URIF"
  ],
  "lineage": {
    "derived_from": [
      "Win32 Winlocker Extortion Lineage"
    ],
    "variants": [
      "Trojan-Ransom.Win32.Nakoctb.A",
      "Ransom:Win32/Nakoctb.gen",
      "Win32/Nakoctb.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
      "4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a"
    ],
    "delivery": [
      "Malicious spam email attachments (.doc, .zip)",
      "Trojanized codec downloads and media players",
      "Drive-by compromises hosting exploit kits"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinBlocker",
      "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell redirected to malware executable"
    ]
  },
  "yara_rules": [
    "rule Ransom_Win32_Nakoctb { meta: description = \"Detects Nakoctb / naKocTb Windows screenlocker ransomware\" strings: $s1 = \"DisableTaskMgr\" $s2 = \"DisableRegistryTools\" $s3 = \"naKocTb\" nocase $s4 = \"Winlogon\" condition: uint16(0) == 0x5A4D and 3 of ($s*) }"
  ],
  "sources": [
    {
      "name": "Kaspersky Securelist - Trojan-Ransom.Win32 Threat Intelligence",
      "url": "https://securelist.com"
    },
    {
      "name": "Check Point Threat Intelligence - naKocTb Analysis",
      "url": "https://research.checkpoint.com"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Ransom:Win32/Nakoctb",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Nakoctb"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}