{
  "family": "phny",
  "sample_count": 25,
  "category": "ransomware",
  "description": "Phny (identified across endpoint security databases under signatures including Ransom:Win32/Phny, Trojan-Ransom.Win32.Phny, and Trojan.Phny) is a destructive crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through malicious spam campaigns with macro-enabled attachments and drive-by download compromise chains, Phny executes rapid evasion and reconnaissance routines upon system infiltration. Phny terminates database, backup, and endpoint security processes to release open file handles before traversing local storage drives, removable media, and mounted network file shares. Using AES-256 symmetric encryption combined with RSA public-key protection, Phny encrypts documents, spreadsheets, databases, and archives, appending an extortion extension to affected files. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), alters desktop background settings to display extortion notices, and demands cryptocurrency ransoms in exchange for a proprietary decryptor.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Phny",
    "Trojan-Ransom.Win32.Phny",
    "Trojan.Phny",
    "Win32/Phny",
    "Ransom:Win32/Phny.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Phny?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Phny is a crypto-ransomware family that encrypts user documents with AES-256 and demands cryptocurrency ransom for recovery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Phny prevent data recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin to purge Volume Shadow Copies and disables Windows automated startup recovery using bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are targeted by Phny for encryption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets business documents, spreadsheets, databases, archives, and multimedia files across local and network drives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Phny infect enterprise computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious spam emails with weaponized attachments and compromised software download portals."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures effectively prevent Phny damage?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Maintain offline immutable backups, enable Controlled Folder Access in Microsoft Defender, and restrict execution of unauthorized scripts."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Macro Documents",
    "Exploit Kit Drive-by Compromise",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "AES-256 / RSA-2048 File Encryption",
    "Volume Shadow Copy Purging (vssadmin)",
    "Network Share Traversal & Locking",
    "Desktop Wallpaper Extortion Display",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Ransom Note Text / HTML File"
    ],
    "network_signatures": [
      "HTTP/HTTPS POST requests transmitting victim system UID and generated encryption session keys to remote C2 servers",
      "Tor-routed payment portal communications for ransom negotiation"
    ],
    "evasion_techniques": [
      "Killing database and backup software processes via taskkill prior to encryption",
      "Dynamic API resolution through PEB hash lookups to conceal cryptographic API calls"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7bf2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0",
      "8ca3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PhnyLocker",
      "HKCU\\Control Panel\\Desktop\\Wallpaper"
    ],
    "file_paths": [
      "%Temp%\\phny.exe",
      "%Desktop%\\HOW_TO_RESTORE_FILES.txt",
      "%AppData%\\Phny\\keys.dat"
    ]
  },
  "defensive_measures": [
    "Implement automated, air-gapped backups to ensure full recovery capability without ransom payments",
    "Enable Controlled Folder Access in Microsoft Defender to safeguard critical document repositories",
    "Block command-line invocations of vssadmin delete shadows using endpoint behavioral detection rules"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Phny",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Phny"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Phny",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Phny.A",
      "Ransom:Win32/Phny.B"
    ]
  },
  "motivation": "Financial Cybercrime & Extortion Ransom Payments",
  "sample_hashes": []
}