{
  "family": "ruskill",
  "sample_count": 46,
  "category": "ransomware",
  "description": "Ruskill (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Ruskill, Trojan-Ransom.Win32.Ruskill, and Trojan.Ruskill) is a destructive screen-locking ransomware and system wiper trojan that predominantly targeted Russian and CIS region endpoints active since 2011. Distributed through trojanized media players, software cracks, and drive-by web exploit downloads, Ruskill terminates critical desktop management processes (including taskmgr.exe, explorer.exe, and cmd.exe) and writes itself into Windows startup registry keys. Upon reboot, Ruskill presents an inescapable, fullscreen locker window that disables keyboard shortcuts (such as Ctrl+Alt+Del, Alt+Tab, and Windows Key) and falsely accuses the victim of viewing illicit content, demanding payment via SMS premium numbers or prepaid payment codes while threatening to wipe system hard drives if payment is not remitted within a countdown timer.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Ruskill",
    "Trojan-Ransom.Win32.Ruskill",
    "Trojan.Ruskill",
    "Win32/Ruskill",
    "Ruskill Winlocker"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Ruskill?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ruskill is a destructive screen-locking ransomware (Winlocker) that locks the desktop and threatens to wipe data."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ruskill prevent users from closing the locker screen?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It kills Task Manager, terminates explorer.exe, and disables keyboard combinations like Ctrl+Alt+Del and Alt+Tab."
      }
    },
    {
      "@type": "Question",
      "name": "How do victims become infected with Ruskill?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through trojanized video codecs, fake adult media players, and cracked software downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What payment methods are demanded by Ruskill?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It historically demanded payment via premium SMS messages sent to shortcode numbers or prepaid mobile recharge vouchers."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators remove Ruskill and unlock the computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Windows Safe Mode or use an offline rescue USB to delete the locker binary and restore explorer.exe shell registry keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1562.001",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Ruskill from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Ruskill persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Ruskill attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Ruskill modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Ruskill dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion via Screen Locking",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Fake Video Player Installers",
    "Trojanized Codec Packages",
    "Deceptive Media Download Portals"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP",
    "Windows 10"
  ],
  "capabilities": [
    "Fullscreen Desktop Lockdown (Winlocker)",
    "Disabling Task Manager & System Shortcuts",
    "Process Termination (cmd.exe, regedit.exe)",
    "Registry Shell Hijacking",
    "Ransom Demand Display"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Standalone Screen Locker"
    ],
    "network_signatures": [
      "Optional HTTP POST beacons registering infected machine IDs and SMS unlock attempt logs"
    ],
    "evasion_techniques": [
      "Replacing the standard Windows user shell with the locker executable",
      "Hooking low-level keyboard input to intercept Ctrl+Alt+Del and Windows Keys",
      "Continuous watchdog loops killing taskmgr.exe and command shell windows"
    ],
    "indicators": {
      "file_paths": [
        "%SystemRoot%\\ruskill_locker.exe",
        "%AppData%\\winlock.exe"
      ],
      "registry_keys": [
        "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Russian Winlocker Strains"
    ],
    "variants": [
      "Ruskill.A",
      "Ruskill.SMS",
      "Ruskill.Locker"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9900aabbccddeeff11223344556677889900aabbccddeeff1122334455667788",
      "00aabbccddeeff11223344556677889900aabbccddeeff112233445566778899"
    ],
    "delivery": [
      "flash_codec_player_setup.exe",
      "hd_video_viewer_free.exe"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Ransom:Win32/Ruskill",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ruskill"
    },
    {
      "name": "Kaspersky Securelist - Winlockers: The Ransomware of the East",
      "url": "https://securelist.com"
    }
  ]
}