{
  "family": "rapid",
  "sample_count": 18,
  "category": "ransomware",
  "description": "Rapid (classified across cybersecurity telemetry under designations including Ransom:Win32/Rapid, Trojan-Ransom.Win32.Rapid, and Win32/Rapid) is a fast-acting Windows crypto-ransomware family first observed in early 2018. Designed for automated extortion across consumer and corporate endpoints, Rapid is distributed via malicious spam emails delivering weaponized executables, compromised remote desktop endpoints, and malicious software repacks. Upon execution, Rapid halts Windows error reporting services and database applications, deletes volume shadow copies with 'vssadmin delete shadows /all /quiet', and suppresses system recovery prompts via 'bcdedit /set {default} bootstatuspolicy ignoreallfailures'. Rapid creates a persistent autostart entry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and continues monitoring the filesystem for newly connected drives and created files. Rapid encrypts files using a hybrid cryptographic scheme combining AES-256 with an embedded RSA master public key, appending .rapid or unique victim ID tags to filenames, and generates ransom notes ('How To Restore Files.txt') directing victims to ProtonMail and Tor portals.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Rapid",
    "Trojan-Ransom.Win32.Rapid",
    "Win32/Rapid",
    "Ransom.Rapid",
    "Rapid Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Rapid?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rapid is a fast-acting Windows crypto-ransomware family that encrypts local storage and newly created files using AES-256 and RSA cryptography."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rapid achieve continuous background encryption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It remains running in the background, monitoring for newly connected storage drives or newly created files to encrypt them immediately."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rapid disable Windows system recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to purge volume shadow copies and bcdedit to suppress automatic boot recovery prompts."
      }
    },
    {
      "@type": "Question",
      "name": "How is Rapid delivered to victim computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious spam email attachments, compromised RDP connections, and Trojanized software repacks."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted with the .rapid extension be decrypted for free?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No public decrypter exists because Rapid uses AES-256 with keys protected by an asymmetric RSA master public key."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1083",
    "T1489"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Spam Emails with Weaponized Loaders",
    "Compromised Remote Desktop Protocol (RDP)",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Continuous Background Drive & File Monitoring",
    "Hybrid Cryptography (AES-256 + RSA)",
    "Volume Shadow Copy & Boot Recovery Deletion",
    "Autostart Registry Run Key Persistence",
    "Automated Ransom Note Generation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound HTTP/HTTPS traffic reporting victim ID and encryption metrics",
      "Connections to anonymous ProtonMail or Tor negotiation portals"
    ],
    "evasion_techniques": [
      "Disabling Windows Error Reporting to prevent crash telemetry upload",
      "Terminating database and antivirus processes to prevent file locks"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "1f2e3d4c5b6a708192a3b4c5d6e7f8a9b0c1d2e3",
      "2e3d4c5b6a708192a3b4c5d6e7f8a9b0c1d2e3f4"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RapidLocker"
    ],
    "file_paths": [
      "%AppData%\\Rapid\\rapid.exe",
      "C:\\How To Restore Files.txt"
    ]
  },
  "defensive_measures": [
    "Maintain immutable, air-gapped backups to ensure full recovery without ransom payments",
    "Enforce strict multi-factor authentication on all external-facing remote access endpoints",
    "Deploy endpoint detection and response (EDR) rules detecting execution of vssadmin delete shadows"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Rapid",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Rapid"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Rapid",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Rapid.A",
      "Ransom:Win32/Rapid.v2",
      "Ransom:Win32/Rapid.v3"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Data Encryption",
  "sample_hashes": []
}