{
  "family": "pasta",
  "sample_count": 20,
  "category": "ransomware",
  "description": "Pasta (identified in antimalware telemetry under signatures Ransom:Win32/Pasta, Trojan-Ransom.Win32.Pasta, and Win32/Pasta) is an extortion crypto-ransomware family targeting Microsoft Windows endpoints. Propagated through spearphishing email campaigns, weaponized macros, and drive-by exploit kits, Pasta conducts immediate host reconnaissance upon execution. It terminates database management processes, backup daemons, and virtualization services using taskkill to unlock files. Pasta traverses local disk volumes, removable drives, and connected network shares, encrypting documents, spreadsheets, databases, and archives using AES-256 encryption wrapped with an embedded RSA public key. It executes shell commands invoking vssadmin to delete Volume Shadow Copies and uses bcdedit to disable automatic Windows startup recovery. It drops ransom notes in encrypted folders demanding cryptocurrency payment in exchange for a decryption utility.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Pasta",
    "Trojan-Ransom.Win32.Pasta",
    "Win32/Pasta",
    "Ransom.Pasta",
    "Ransom:Win32/Pasta.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Pasta?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pasta is a crypto-ransomware family that encrypts files on Windows devices with AES-256 and demands cryptocurrency ransom."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pasta disable system recovery mechanisms?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet to purge Volume Shadow Copies and disables startup recovery using bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are targeted by Pasta ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets office documents, spreadsheets, databases, financial records, archives, and media files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pasta infect enterprise environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It infects environments via spearphishing emails with malicious attachments, weaponized macros, and exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended recovery response for Pasta ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the network immediately, terminate active processes, and restore encrypted files from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Pasta",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Pasta"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Pasta",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_pasta"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Pasta",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Pasta"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from network connections immediately to halt encryption across shared network drives.",
    "Kill active ransomware processes via Windows Task Manager or elevated PowerShell commands.",
    "Preserve forensic memory dumps and sample files for threat intelligence and hash matching.",
    "Block delivery vectors including malicious URLs and sender email domains.",
    "Restore encrypted files from air-gapped, immutable backup archives."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency ransom demand; it funds illicit cybercrime activities without guarantee of recovery.",
    "Do not reboot systems before securing volatile memory data."
  ],
  "target_industries": [
    "Manufacturing",
    "Healthcare",
    "Retail",
    "Commercial Businesses"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}