{
  "family": "schoolboy",
  "sample_count": 21,
  "category": "ransomware",
  "description": "Schoolboy (identified in endpoint telemetry as Ransom:Win32/Schoolboy, Trojan-Ransom.Win32.Schoolboy, and Win32/Schoolboy) is a targeted crypto-ransomware family designed to extort organizations and individual Windows users. Delivered via spearphishing emails carrying malicious document attachments and compromised software downloads, Schoolboy initiates execution by verifying administrative privileges and disabling Windows security features. It traverses mounted local fixed disks, removable drives, and connected network shares, encrypting documents, databases, code repositories, and media files using symmetric AES or ChaCha20 encryption with RSA key protection. Schoolboy executes command-line instructions invoking vssadmin to delete all Volume Shadow Copies and uses bcdedit to disable Windows automated startup recovery. It alters desktop wallpaper to an extortion banner and deposits text ransom notes instructing victims to pay a cryptocurrency ransom for a decryption tool.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Schoolboy",
    "Trojan-Ransom.Win32.Schoolboy",
    "Win32/Schoolboy",
    "Ransom.Schoolboy",
    "Ransom:Win32/Schoolboy.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Schoolboy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Schoolboy is a crypto-ransomware family that encrypts Windows endpoint data and demands cryptocurrency payment for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Schoolboy prevent recovery using Windows Shadow Copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet to purge Volume Shadow Copies and disables startup recovery using bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What storage locations are targeted by Schoolboy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets local hard disks, external USB drives, and accessible SMB network shares."
      }
    },
    {
      "@type": "Question",
      "name": "How does Schoolboy enter target environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enters via spearphishing emails with malicious attachments, weaponized macros, and compromised software repacks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended recovery steps for Schoolboy ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the network, disinfect affected machines, and restore encrypted files from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Schoolboy",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Schoolboy"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Schoolboy",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_schoolboy"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Schoolboy",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Schoolboy"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected endpoint from LAN, WAN, and Wi-Fi networks immediately to stop encryption spreading.",
    "Kill active ransomware processes via Windows Task Manager or elevated PowerShell commands.",
    "Capture volatile physical memory and file samples for cryptographic inspection.",
    "Block delivery domains and malicious sender email addresses at perimeter security gateways.",
    "Reimage compromised workstations and restore business data from immutable offline backups."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency extortion fee, as it does not guarantee decryption key recovery.",
    "Do not connect clean backup drives to the infected system before confirming complete remediation."
  ],
  "target_industries": [
    "Education",
    "Healthcare",
    "Manufacturing",
    "Commercial Enterprises"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}