{
  "family": "sixer",
  "sample_count": 16,
  "category": "ransomware",
  "description": "Sixer (classified in cybersecurity threat databases under designations including Ransom:Win32/Sixer, Trojan-Ransom.Win32.Sixer, and Win32/Sixer) is an evasive crypto-ransomware family designed to execute targeted file encryption across Windows endpoints. Distributed primarily via malicious email attachments, Trojanized freeware archives, and compromised remote access credentials, Sixer incorporates pre-execution evasion checks. It interrogates the system environment for the presence of analysis debuggers (via IsDebuggerPresent and CheckRemoteDebuggerPresent) and active sandbox hooks before deploying its payload. Sixer scans all local fixed disks, removable media, and mapped network drives, identifying high-value files based on an extensive extension list covering documents, databases, spreadsheets, source code, and media archives. It locks targets using AES-256 encryption, appending .sixer to filenames and dropping ransom notes titled READ_SIXER_DECRYPT.txt. Sixer executes administrative shell commands to delete Volume Shadow Copies and disable startup repair.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Sixer",
    "Trojan-Ransom.Win32.Sixer",
    "Win32/Sixer",
    "Sixer Ransomware",
    "Ransom.Sixer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Sixer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sixer is a crypto-ransomware family that encrypts user documents, databases, and media on Windows systems using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sixer identify files to encrypt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks file extensions against a hardcoded list of productivity formats, databases, archives, and developer code files."
      }
    },
    {
      "@type": "Question",
      "name": "What evasion techniques does Sixer employ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It calls debugger detection APIs and checks for virtualization artifacts to evade sandbox analysis environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sixer prevent local data recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It deletes Windows Volume Shadow Copies via vssadmin and disables automatic recovery using bcdedit commands."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended recovery plan for Sixer victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect infected machines from the local network, preserve encrypted files for future decryptor availability, and restore from backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1497.001",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Sixer from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Sixer persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Sixer attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Sixer modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Sixer dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Sixer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Sixer"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}