{
  "family": "sugar",
  "sample_count": 80,
  "category": "ransomware",
  "description": "Sugar (tracked across cybersecurity threat intelligence feeds under aliases including Sugar Ransomware, Encoded01, and Ransom.Encoded01) is a Delphi-based Ransomware-as-a-Service (RaaS) operation first identified by Walmart security researchers in November 2021. Distinct from high-profile corporate enterprise cartels, Sugar primarily targeted consumer workstations and small businesses with dynamically scaled, relatively low ransom demands. Upon execution, Sugar queries public geolocation APIs (such as whatismyipaddress.com and ip2location.com) to log victim IP addresses before deploying a multi-threaded SCOP encryption algorithm to encrypt user documents, photos, and databases, appending the '.encoded01' extension. The ransomware skips critical operating system directories (such as \\Windows and \\Boot) to keep the host functional, places a Tor browser shortcut on the desktop, and drops ransom notes titled 'BackFiles_encoded01.txt' directing victims to dark web payment portals on sugarpanel.space that mirror the visual aesthetics of REvil and Cl0p.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Sugar",
    "Ransom.Encoded01",
    "Win32/Sugar",
    "Encoded01"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Sugar Ransomware (Encoded01)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sugar is a Delphi-based ransomware family that encrypts consumer and small business files with the .encoded01 extension."
      }
    },
    {
      "@type": "Question",
      "name": "Which encryption algorithm is utilized by Sugar?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sugar uses the SCOP encryption algorithm paired with public/private keys to lock victim data."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sugar determine the victim's ransom amount?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The ransom demand is dynamically calculated based on the total quantity and volume of files encrypted."
      }
    },
    {
      "@type": "Question",
      "name": "What ransom note is dropped by Sugar Ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It drops 'BackFiles_encoded01.txt' containing instructions and links to Tor negotiation portals."
      }
    },
    {
      "@type": "Question",
      "name": "How can victims recover from a Sugar infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the computer, terminate the ransomware process, clean malware binaries, and restore files from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1059.003",
    "T1547.001",
    "T1082",
    "T1016",
    "T1027",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactic": "Impact"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately sever the infected endpoint and any mapped network segments from the corporate network to halt the spread of the encryption process.",
    "Do NOT reboot the machine immediately; capture a forensic RAM image to preserve memory, which may contain decryption keys or critical forensic data.",
    "Identify the initial access vector (e.g., compromised VPN credentials, phishing) and the lateral movement path to ensure the attacker is fully eradicated.",
    "Initiate disaster recovery protocols using offline, immutable backups; do not pay the ransom unless explicitly advised by law enforcement and legal counsel."
  ],
  "what_to_avoid": [
    "Do not connect any external drives or network shares to the infected machine, as the ransomware will immediately attempt to encrypt them.",
    "Avoid executing any files or attempting manual recovery without a forensic image; altering the disk state can permanently corrupt the encrypted data."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2021,
  "threat_actor": "Sugar RaaS Operators",
  "delivery_mechanism": [
    "Pirated Software & Keygens",
    "Exploit Kits & Malvertising",
    "Phishing Emails with Malicious Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "SCOP File Encryption",
    "Dynamic Ransom Calculation",
    "Public IP Geolocation Querying",
    "Tor Portal Integration",
    "System Directory Exclusion"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Text File (.txt)"
    ],
    "network_signatures": [
      "HTTP GET requests to whatismyipaddress.com and ip2location.com",
      "Encrypted C2 check-ins to sugarpanel.space"
    ],
    "evasion_techniques": [
      "Multi-threaded execution frustrating static reverse engineering",
      "Shared crypter string-decoding routines"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SugarRansom",
      "Desktop Tor Browser shortcut creation"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "High",
    "availability": "High",
    "scope": "Personal and enterprise user documents, permanent file encryption, extortion payment demands"
  },
  "lineage": {
    "derived_from": [
      "Commercial Delphi Ransomware Strains"
    ],
    "variants": [
      "Sugar.Encoded01",
      "Sugar.RaaS"
    ]
  },
  "iocs": {
    "file_hashes": [
      "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
      "f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7"
    ],
    "delivery": [
      "sugar_payload.exe",
      "document_decryptor.exe"
    ],
    "persistence": [
      "BackFiles_encoded01.txt",
      "%Desktop%\\Tor Browser.lnk"
    ]
  },
  "sources": [
    {
      "name": "BleepingComputer - Sugar Ransomware Analysis & Campaign Profile",
      "url": "https://www.bleepingcomputer.com"
    },
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - Ransom.Encoded01 (Sugar)",
      "url": "https://www.malwarebytes.com/threats/encoded01"
    }
  ]
}