{
  "family": "samsam",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Ransom:Win32/SamSam (also known as Samas) is a highly destructive, **Targeted Ransomware** family that gained infamy for crippling hospitals, municipalities, and large enterprises (most notably the City of Atlanta in 2018). Unlike traditional 'spray-and-pray' ransomware spread via mass phishing, SamSam is characterized by its *manual deployment*. Attackers breach the network, map the infrastructure, and deliberately execute the encryptor for maximum extortion impact.<br><br><b>Understanding SamSam (Targeted Ransomware)</b><br>To an end-user, the impact is catastrophic: servers and workstations are suddenly encrypted, appended with the `.weapologize` extension (or similar), and a ransom note (`PLEASE_READ_FOR_DECRYPT.txt`) demands massive cryptocurrency payments. For an incident response team, a SamSam infection means a human adversary has been actively roaming the network for days or weeks, escalating privileges and intentionally disabling backups before launching the final payload.<br><br><b>Execution and Manual Deployment Mechanics</b><br>The initial attack vector is almost never an email. Attackers typically exploit vulnerable, public-facing infrastructure, most commonly brute-forcing or exploiting unpatched Remote Desktop Protocol (RDP) servers or vulnerable JBoss application servers (`T1190`, `T1133`). Once inside, they use legitimate tools (like Mimikatz and PsExec) to harvest domain admin credentials (`T1003.001`) and move laterally (`T1569.002`). The attackers then manually copy the SamSam encryptor binary to critical servers and workstations. They often use batch scripts to systematically delete Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) and then manually execute the SamSam payload using an RSA-2048/AES-256 hybrid encryption scheme (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total operational paralysis and severe financial loss. Host-based IoCs include the presence of the SamSam executable (often named `sysname.exe` or `svchost.exe` running from odd locations), the execution of `vssadmin` or `bcdedit` commands just prior to encryption, and the specific `.weapologize` or `.samsam` file extensions. Network IoCs include a massive spike in internal RDP traffic and SMB file transfers (PsExec) leading up to the event, as the attacker manually distributes the payload.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Samsam and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Samsam is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Samsam establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Samsam typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Samsam compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Samsam should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Samsam employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Samsam typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Samsam, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Samsam depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1133",
    "T1486",
    "T1490",
    "T1569.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1133",
      "name": "External Remote Services (Initial access via RDP)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1569.002",
      "name": "System Services: Service Execution (Lateral movement via PsExec)",
      "tactic": "Execution"
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Shadow Copies)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "IMMEDIATELY isolate all affected subnets and shut down any exposed RDP gateways to prevent further lateral movement by the active human adversary.",
    "Do not assume the attack is over once encryption starts; the attackers may still have persistence via backdoors or compromised domain admin accounts.",
    "Identify the initial entry point (e.g., exposed RDP on a specific server) and patch/secure it before attempting restoration.",
    "Restore systems from offline, immutable backups; SamSam attackers deliberately target and encrypt connected backup servers."
  ],
  "what_to_avoid": [
    "Do not treat a SamSam infection as an automated virus event; you must hunt for the active attacker's persistence mechanisms and compromised accounts.",
    "Avoid paying the ransom; SamSam operators have occasionally failed to provide working decryptors even after payment."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}