{
  "family": "pajetbin",
  "sample_count": 21,
  "category": "ransomware",
  "description": "Pajetbin (classified across threat telemetry as Ransom:Win32/Pajetbin, Trojan-Ransom.Win32.Pajetbin, and Win32/Pajetbin) is a destructive crypto-ransomware family targeting Windows workstations and network servers. Propagated through weaponized email phishing attachments, cracked software utilities, and exploit kits, Pajetbin performs swift host reconnaissance upon execution. It terminates active database processes, mail servers, and backup utilities via taskkill to release file system locks across local hard drives and mapped SMB network shares. Pajetbin encrypts target data files—including office documents, accounting spreadsheets, databases, and archives—using AES-256 encryption wrapped with an embedded RSA public key, appending a unique extension (such as .pajetbin) to locked files. It executes vssadmin delete shadows /all /quiet to purge Volume Shadow Copies and leaves ransom notices instructing victims on cryptocurrency extortion payments.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Pajetbin",
    "Trojan-Ransom.Win32.Pajetbin",
    "Win32/Pajetbin",
    "Ransom.Pajetbin",
    "Ransom:Win32/Pajetbin.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Pajetbin?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pajetbin is a crypto-ransomware family that locks Windows files using AES-256 and demands cryptocurrency ransom for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pajetbin eliminate system recovery points?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet to silently delete all Windows Volume Shadow Copies."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are targeted by Pajetbin?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets office documents, spreadsheets, databases, archives, financial records, and media files."
      }
    },
    {
      "@type": "Question",
      "name": "How is Pajetbin ransomware distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed through phishing emails with weaponized attachments, malicious downloads, and exploit kit droppers."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended response to a Pajetbin infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the network immediately, terminate malicious processes, and restore encrypted files from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Pajetbin",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Pajetbin"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Pajetbin",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_pajetbin"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Pajetbin",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Pajetbin"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Sever network connections immediately to halt ransomware propagation across network shares.",
    "Kill active ransomware processes using Task Manager or command-line commands.",
    "Capture memory forensics and binary samples for malware analysis and IOC generation.",
    "Block malicious email domains and delivery infrastructure across perimeter firewalls.",
    "Rebuild affected systems and restore files from validated offline backup media."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency ransom demand, as it encourages further cyberattacks without recovery guarantee.",
    "Do not connect backup media to the affected machine before verifying full disinfection."
  ],
  "target_industries": [
    "Manufacturing",
    "Healthcare",
    "Financial Services",
    "Retail"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}