{
  "family": "scarab",
  "sample_count": 57,
  "category": "ransomware",
  "description": "Scarab (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Scarab, Trojan-Ransom.Win32.Scarab, and Ransom.Scarab) is a landmark ransomware family first identified in June 2017 that achieved widespread notoriety in November 2017 when the massive Necurs botnet pushed millions of malicious spam emails containing Scarab downloaders. Built using Delphi and C++, Scarab is delivered through 7Zip archives carrying weaponized VBScript downloaders disguised as scanned invoice notifications. Once launched, Scarab elevates privileges, terminates system services, and purges backup repositories by executing vssadmin.exe delete shadows /all /quiet and wbadmin DELETE SYSTEMSTATEBACKUP. The malware rapidly encrypts target files using AES-256 and encrypts the AES keys with an embedded RSA-2048 master public key. Scarab renames locked files with the .scarab extension (or variant tags like .scarab-scrypt) and deposits a ransom note titled 'IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT' detailing Bitcoin ransom instructions.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Scarab",
    "Trojan-Ransom.Win32.Scarab",
    "Ransom.Scarab",
    "Scarab Ransomware",
    "Win32/Scarab"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Scarab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Scarab is a landmark ransomware family that infected worldwide networks via mass campaigns orchestrated by the Necurs botnet."
      }
    },
    {
      "@type": "Question",
      "name": "How was Scarab ransomware primarily distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through millions of Necurs botnet spam emails with 7Zip archives containing VBScript downloaders."
      }
    },
    {
      "@type": "Question",
      "name": "What encryption methods are used by Scarab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Scarab encrypts files using AES-256 and wraps the symmetric key using an embedded RSA-2048 public key."
      }
    },
    {
      "@type": "Question",
      "name": "What is the ransom note filename created by Scarab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The ransom note is named 'IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT'."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Scarab attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block inbound malicious archive attachments, maintain offline immutable backups, and restrict VBScript execution."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1059.005",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint from the network to halt the encryption process, specifically protecting mapped network shares and cloud syncing folders.",
    "Do NOT reboot or power off the machine immediately; capture a live memory image. The encryption keys may still reside in RAM.",
    "Identify the initial infection vector (likely a phishing email) and purge similar messages from the corporate email gateway.",
    "Restore affected systems from offline, immutable backups that were not accessible to the network during the encryption phase."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; there is no guarantee the attackers will provide a working decryptor, and paying funds criminal enterprises.",
    "Avoid reconnecting the machine to the network until it has been completely wiped and rebuilt from a known-clean image."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Necurs Botnet Email Spam",
    "7Zip Archive Attachments with VBScript",
    "Malicious Macro Documents"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server 2016"
  ],
  "capabilities": [
    "AES-256 & RSA-2048 File Encryption",
    "Volume Shadow Copy Deletion",
    "Mass Botnet Email Propagation",
    "Registry Autostart Persistence",
    "Ransom Note Deployment"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi / C++)",
      "VBScript Stager (.vbs)"
    ],
    "network_signatures": [
      "HTTP GET requests downloading payload binaries from compromised WordPress staging servers",
      "TOR communication channels for ransom payment negotiation"
    ],
    "evasion_techniques": [
      "Archive nesting inside 7Zip containers to bypass mail gateways",
      "VBScript string obfuscation and environment fingerprinting",
      "Deleting Windows shadow copies and system state backups"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\secur32.exe",
        "%Desktop%\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ScarabAutostart"
      ]
    }
  },
  "severity": "critical",
  "lineage": {
    "derived_from": [
      "Scarab Core Codebase"
    ],
    "variants": [
      "Scarab-Scrypt",
      "Scarab-AMNESIA",
      "Scarab-Walker"
    ]
  },
  "iocs": {
    "file_hashes": [
      "0718293a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abc",
      "18293a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcd0"
    ],
    "delivery": [
      "scanned_document_invoice_49102.7z",
      "document_scan_9021.vbs"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ScarabAutostart"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Ransom:Win32/Scarab",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Scarab"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.SCARAB",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.scarab"
    }
  ]
}