{
  "family": "shakblades",
  "sample_count": 48,
  "category": "ransomware",
  "description": "Shakblades is a destructive Windows ransomware strain active since 2017. Propagated primarily through trojanized software activators, cracked utilities, and exploit kits, Shakblades executes rapid encryption routines across local drives and accessible network shares. The malware invokes vssadmin.exe delete shadows /all /quiet and wbadmin delete catalog -quiet to inhibit system recovery, terminates database and enterprise processes, and uses AES-256 encryption wrapped with an embedded RSA public key to lock target document, media, and database files. It appends the .shakblades extension to locked files and generates desktop ransom instructions demanding Bitcoin payment for file restoration.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Shakblades",
    "Trojan-Ransom.Win32.Shakblades",
    "Ransom.Shakblades",
    "Win32/Shakblades"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Shakblades?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Shakblades is a destructive ransomware strain that encrypts local and network files, demanding cryptocurrency."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms does Shakblades use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses AES-256 for symmetric file encryption combined with RSA public-key protection for the encryption keys."
      }
    },
    {
      "@type": "Question",
      "name": "How does Shakblades prevent system recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It deletes volume shadow copies with vssadmin.exe and deletes the backup catalog via wbadmin."
      }
    },
    {
      "@type": "Question",
      "name": "What extension is added to encrypted documents?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Files encrypted by the malware are renamed with the .shakblades extension."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations recover from a Shakblades attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Restore uninfected files from immutable offline backups, scrub malicious binaries, and patch initial entry points."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1059.003",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Shakblades from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Shakblades persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Shakblades attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Shakblades modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Shakblades dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Software Activators",
    "Cracked Game Packages",
    "Exploit Kit Redirections"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "AES-256 File Data Encryption",
    "Volume Shadow Copy Deletion",
    "Backup Catalog Purging",
    "Database Service Termination",
    "Desktop Ransom Note Generation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "C++ Standalone Binary"
    ],
    "network_signatures": [
      "Optional TOR network communications for payment portal negotiations",
      "ICMP echo checks validating internet connectivity"
    ],
    "evasion_techniques": [
      "Process termination of local antivirus and security monitoring services",
      "Clearing Windows Event Logs using wevtutil",
      "Disabling system recovery and startup error alerts"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\shakblades.exe",
        "%Desktop%\\HOW_TO_DECRYPT_SHAKBLADES.txt"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShakbladesLocker"
      ]
    }
  },
  "severity": "critical",
  "lineage": {
    "derived_from": [
      "Shakblades Ransomware Core"
    ],
    "variants": [
      "Shakblades.A",
      "Shakblades.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "cc33dd44ee55ff6677889900aabbccddeeff11223344556677889900aabbccdd",
      "dd44ee55ff6677889900aabbccddeeff11223344556677889900aabbccddeeff"
    ],
    "delivery": [
      "game_trainer_crack.exe",
      "photoshop_activation_keygen.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShakbladesLocker"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Ransom:Win32/Shakblades",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Shakblades"
    },
    {
      "name": "Threat Intelligence Database - Ransom.Win32.Shakblades",
      "url": "https://www.virustotal.com/gui/file-analysis"
    }
  ]
}