{
  "family": "talent",
  "sample_count": 13,
  "category": "ransomware",
  "description": "Talent (classified in threat databases as Ransom:Win32/Talent and Trojan-Ransom.Win32.Talent) is an evasive crypto-ransomware family designed for rapid and wide-scale data extortion across Windows endpoints. Distributed via malicious malvertising redirects and loader packages, Talent evaluates host privileges and runs anti-debugging checks before commencing encryption. Utilizing AES-256 encryption in CBC mode, Talent encrypts high-value documents, source code, and virtual machine images, appending .talent to filenames. It drops ransom notes titled RESTORE_TALENT_FILES.html on the desktop and within every processed directory, demanding cryptocurrency payment for file restoration while wiping Volume Shadow Copies and system restore points.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Talent",
    "Trojan-Ransom.Win32.Talent",
    "Win32/Talent",
    "Talent Ransomware",
    "Ransom.Talent"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Talent?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Talent is a crypto-ransomware family that encrypts files on Windows endpoints and mapped shares using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "What evasion checks does Talent perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for debugging processes and sandbox artifacts before deploying its cryptographic encryption routines."
      }
    },
    {
      "@type": "Question",
      "name": "Does Talent encrypt network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it traverses mapped drives and SMB shares to encrypt files across connected corporate storage."
      }
    },
    {
      "@type": "Question",
      "name": "How does Talent eliminate Windows shadow copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and disables startup recovery via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended recovery method for Talent victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected endpoint from the network, document ransom indicators, and restore affected files from backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1497.001",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Talent from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Talent persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Talent attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Talent modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Talent dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Talent",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Talent"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Ransom Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}