{
  "family": "reset",
  "sample_count": 13,
  "category": "ransomware",
  "description": "Reset (classified across antivirus engines as Ransom:Win32/Reset and Trojan-Ransom.Win32.Reset) is an aggressive corporate crypto-ransomware family designed to execute destructive file encryption and extortion. Infiltrating networks through exposed remote services and phishing loaders, Reset terminates local database services and backup agents before launching its encryption routine. It uses symmetric AES-256 encryption combined with an embedded RSA public key to encrypt critical business documents, databases, and backup archives across all local and mapped network drives, appending .reset to locked files. It drops ransom notes titled RESET_README.txt, purges Volume Shadow Copies via vssadmin, and disables Windows recovery mode.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Reset",
    "Trojan-Ransom.Win32.Reset",
    "Win32/Reset",
    "Reset Ransomware",
    "Ransom.Reset"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Reset?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Reset is a corporate crypto-ransomware family that encrypts files on Windows endpoints and servers using AES-256 and RSA."
      }
    },
    {
      "@type": "Question",
      "name": "How does Reset avoid open file handle conflicts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It forcibly terminates running processes and services associated with database engines, productivity suites, and backup software."
      }
    },
    {
      "@type": "Question",
      "name": "Does Reset encrypt network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it aggressively traverses local network drives and SMB shares to encrypt centralized enterprise storage."
      }
    },
    {
      "@type": "Question",
      "name": "How does Reset eliminate Volume Shadow Copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and disables automatic recovery options via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended incident response procedure for Reset?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect infected machines from the network, isolate impacted file servers, and restore clean data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Reset from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Reset persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Reset attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Reset modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Reset dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Reset",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Reset"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}