{
  "family": "scriptkd",
  "sample_count": 15,
  "category": "ransomware",
  "description": "Scriptkd (classified as Ransom:Win32/Scriptkd and Trojan-Ransom.Win32.Scriptkd) is a script-based and multi-stage crypto-ransomware family combining Windows Script Host (WSH/VBScript), PowerShell, and compiled PE binaries. Delivered via phishing attachments with .vbs or .wsf files, Scriptkd uses obfuscated script routines to bypass initial email gateways and static scanner heuristics. The script downloads or unpacks an AES-256 cryptographic locker onto the endpoint. Scriptkd traverses mounted drive letters and network shares, encrypting documents, databases, and image archives while appending custom extensions. It executes shell commands to wipe Volume Shadow Copies (vssadmin delete shadows /all /quiet) and creates persistent desktop ransom notifications.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Scriptkd",
    "Trojan-Ransom.Win32.Scriptkd",
    "Win32/Scriptkd",
    "Scriptkd Ransomware",
    "Ransom.Scriptkd"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Scriptkd?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Scriptkd is a hybrid script-based ransomware family that uses obfuscated scripts to deliver crypto-ransomware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Scriptkd bypass email security filters?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It embeds multi-layer obfuscation and string encoding inside VBScript or WSF script wrappers."
      }
    },
    {
      "@type": "Question",
      "name": "What encryption methods does Scriptkd use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It deploys AES-256 symmetric file encryption with asymmetric key encapsulation."
      }
    },
    {
      "@type": "Question",
      "name": "How does Scriptkd eliminate system restore options?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs vssadmin to delete all Volume Shadow Copies and uses bcdedit to disable automatic startup recovery."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended mitigation against script-based ransomware like Scriptkd?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block executable script attachments (.vbs, .js, .wsf) at email gateways and associate script extensions with Notepad."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.005",
    "T1059.001",
    "T1486",
    "T1490",
    "T1083",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic",
      "tactic": "Execution"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; if `wscript.exe` successfully executed the Scriptkd payload, a secondary infection (like ransomware) is actively downloading or running.",
    "Use EDR to immediately terminate any suspicious `wscript.exe`, `cscript.exe`, or `powershell.exe` processes executing out of user profile directories.",
    "Review network proxies to identify the C2 domains contacted by the script and block them enterprise-wide.",
    "Disable the Windows Script Host (WSH) globally via Group Policy if VBScript execution is not required for business operations."
  ],
  "what_to_avoid": [
    "Do not assume the attack is blocked just because the email gateway stripped the attachment; users may download the script via web links.",
    "Avoid relying solely on static hash signatures for scripts, as attackers dynamically generate new obfuscation patterns for every email sent."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Scriptkd",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Scriptkd"
    },
    {
      "name": "Trend Micro Security Research - Ransom.Win32.Scriptkd Overview",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.scriptkd"
    },
    {
      "name": "MITRE ATT&CK - Command and Scripting Interpreter: Visual Basic (T1059.005)",
      "url": "https://attack.mitre.org/techniques/T1059/005/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}