{
  "family": "shade",
  "sample_count": 72,
  "category": "ransomware",
  "description": "Shade (also widely tracked in cyber threat intelligence feeds as Troldesh, Encoder.858, and Ransom:Win32/Shade) is a landmark ransomware family that terrorized organizations and individual users worldwide from 2014 until its shutdown in 2020. Propagated through massive malicious spam campaigns distributing weaponized zip archives and exploit kits, Shade deployed robust AES-256 and RSA-2048 encryption to lock victim files, appending recognizable extensions such as .xtbl, .ytbl, .breaking_bad, and .better_call_saul. The ransomware terminated database services, deleted Windows Volume Shadow Copies, and dropped multilingual ransom notes demanding payments in Bitcoin. In an unprecedented event in April 2020, the operators behind Shade announced their retirement, publicly apologized to their victims, and published over 750,000 master decryption keys on GitHub. In collaboration with the No More Ransom initiative, Kaspersky and Europol verified the keys and integrated them into the free ShadeDecryptor tool, allowing all historical victims to recover their data.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Shade",
    "Trojan-Ransom.Win32.Shade",
    "Troldesh",
    "Encoder.858",
    "Win32/Troldesh"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was Shade (Troldesh) ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Shade was a prolific ransomware family active from 2014 to 2020 that locked files with extensions like .xtbl."
      }
    },
    {
      "@type": "Question",
      "name": "What happened to the Shade ransomware operation in April 2020?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The authors ceased operations, apologized to victims, and released over 750,000 decryption keys on GitHub."
      }
    },
    {
      "@type": "Question",
      "name": "Can files encrypted by Shade / Troldesh be decrypted for free?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, Kaspersky and Europol built the free ShadeDecryptor tool available on NoMoreRansom.org using the released master keys."
      }
    },
    {
      "@type": "Question",
      "name": "Which encryption algorithms were utilized by Shade?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Shade used a combination of AES-256 in CBC mode and RSA-2048 to lock files and encrypt keys."
      }
    },
    {
      "@type": "Question",
      "name": "What file extensions were commonly appended by Shade ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Common extensions included .xtbl, .ytbl, .breaking_bad, .better_call_saul, and .da_vinci_code."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1547.001",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately sever the infected endpoint and any mapped network shares from the corporate network to halt the spread of the encryption process.",
    "Do NOT reboot the machine immediately; capture a forensic RAM image, as memory analysis may reveal the AES encryption keys if the process is still running.",
    "Verify if the specific variant is covered by the public release of the Shade decryption keys (available via NoMoreRansom); decryption may be possible without paying.",
    "Initiate disaster recovery protocols using offline, immutable backups if decryption is not possible."
  ],
  "what_to_avoid": [
    "Do not connect any external drives or network shares to the infected machine, as the ransomware will immediately attempt to encrypt them.",
    "Avoid paying the ransom; the official Shade operators have shut down, and payments will likely go to copycats who cannot provide the key."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": "Shade / Troldesh Ransomware Syndicate",
  "delivery_mechanism": [
    "Malicious Spam (Malspam) with Malicious Zip Attachments",
    "Nuclear and Magnitude Exploit Kits",
    "Spearphishing Invoices"
  ],
  "target_platforms": [
    "Windows Server 2019",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "AES-256 and RSA-2048 File Encryption",
    "Shadow Copy Deletion (vssadmin)",
    "Database and Backup Service Termination",
    "Multilingual Ransom Note Generation",
    "Tor-Based Payment Portal Integration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Text File (.txt)",
      "HTML File (.html)"
    ],
    "network_signatures": [
      "Encrypted C2 check-in over Tor proxy connections",
      "HTTP POST beacons transmitting victim machine GUIDs"
    ],
    "evasion_techniques": [
      "Disabling Windows Error Reporting to prevent crash telemetry upload",
      "Dynamic API resolution through hash tables to frustrate disassemblers"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShadeRansom",
      "Registry Startup run keys dropping ransomware notes on boot"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "High",
    "availability": "High",
    "scope": "Permanent enterprise file encryption, critical service interruption, extortion demands"
  },
  "lineage": {
    "derived_from": [
      "Custom Russian Cybercrime Ransomware Strains"
    ],
    "variants": [
      "Troldesh.A",
      "Troldesh.XTBL",
      "Encoder.858"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b",
      "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c"
    ],
    "delivery": [
      "invoice_scan.zip",
      "order_details.exe"
    ],
    "persistence": [
      "README_TXT.txt",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsSecurityUpdate"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Securelist - Shade Ransomware Shuts Down & Releases Master Decryption Keys",
      "url": "https://securelist.com"
    },
    {
      "name": "No More Ransom Project (Europol) - ShadeDecryptor Utility",
      "url": "https://www.nomoreransom.org"
    }
  ]
}