{
  "family": "teslacrypt",
  "sample_count": 9,
  "category": "ransomware",
  "description": "TeslaCrypt is a notorious ransomware family first detected in February 2015 that achieved widespread prominence by specifically targeting video gamers—encrypting game saves, maps, player profiles, and user modifications for over 40 popular video games (including Call of Duty, World of Warcraft, Minecraft, Fallout, and League of Legends) alongside standard business documents.\n\nTeslaCrypt was primarily distributed through exploit kits (Angler, Nuclear, Sweet Orange) leveraging Adobe Flash Player zero-day vulnerabilities (CVE-2015-0311, CVE-2015-5119). In May 2016, TeslaCrypt concluded in one of the most remarkable events in cybercrime history: the ransomware operators abruptly announced they were shutting down their operations, posting an apology note on their Tor payment site ('Project closed. We are sorry!') and publicly publishing the master private encryption key. Security researchers at ESET and Cisco Talos immediately utilized the master key to create free universal decryption utilities, allowing every affected victim worldwide to restore their encrypted files without paying ransom.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "TeslaCrypt",
    "Trojan.TeslaCrypt",
    "Win32/TeslaCrypt",
    "Ransom.TeslaCrypt"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was TeslaCrypt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "TeslaCrypt was a ransomware strain active in 2015-2016 that became famous for encrypting gaming files and save states for over 40 video games."
      }
    },
    {
      "@type": "Question",
      "name": "How did TeslaCrypt end?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In May 2016, the authors unexpectedly shut down the project, published a public apology, and released the master private key allowing free file decryption."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were used to infect computers with TeslaCrypt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "TeslaCrypt was heavily distributed through exploit kits targeting Adobe Flash Player vulnerabilities such as CVE-2015-0311 and CVE-2015-5119."
      }
    },
    {
      "@type": "Question",
      "name": "What file extensions were used by TeslaCrypt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "TeslaCrypt used extensions including .ecc, .ezz, .exx, .xyz, .zzz, .aaa, .abc, .ccc, .vvv, .micro, and .mp3."
      }
    },
    {
      "@type": "Question",
      "name": "Is a free decryptor available for TeslaCrypt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, security vendors including ESET and Cisco Talos released free universal decryption tools using the authors' published master key that recover all files."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1071.001",
    "T1566.001",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (Encrypting documents and game saves)",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Angler Exploit Kit distribution)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Shadow Copies)",
      "tactic": "Impact"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery (Scanning for 185+ extensions)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "If encountering a legacy TeslaCrypt infection, DO NOT format the drive. The universal master decryption key is publicly available, and tools exist (e.g., from ESET or McAfee) to recover 100% of the files for free.",
    "Isolate the endpoint to prevent any potential lateral movement, although TeslaCrypt primarily focused on local and mapped drive encryption.",
    "Run the free TeslaCrypt decryption tool to restore the encrypted files.",
    "Use an enterprise antivirus solution to scan for and remove the dormant TeslaCrypt executable and its associated registry persistence mechanisms."
  ],
  "what_to_avoid": [
    "Do NOT pay the ransom under any circumstances; the operation is defunct, the infrastructure is offline, and a free decryptor exists.",
    "Avoid deleting the encrypted files in a panic; they are fully recoverable using the public master key."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "lineage": {
    "derived_from": [],
    "variants": [
      "teslacrypt v1.0",
      "teslacrypt v2.0 (.vvv, .ccc, .abc)",
      "teslacrypt v3.0 (.micro, .mp3)",
      "teslacrypt v4.0 (master key release)"
    ]
  },
  "attribution": [
    {
      "actor": "TeslaCrypt Cybercrime Authors / May 2016 Public Master Key Release",
      "confidence": "high",
      "basis": "Active cybercrime syndicate between February 2015 and May 2016. In May 2016, the operators voluntarily closed the project, issued a public apology, and released the master private key used by ESET to decrypt all victims globally.",
      "source": "https://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-teslacrypt-ransomware/"
    }
  ],
  "exploited_cves": [
    "CVE-2015-0311",
    "CVE-2015-5119"
  ],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "HTTPS",
      "Tor Onion Routing",
      "ECDH & AES-CBC"
    ],
    "ports": [
      80,
      443
    ],
    "infrastructure": "Exploit kit distribution networks directing compromised hosts to Tor hidden services (.onion) for ransom payment and private key delivery, shut down voluntarily in May 2016."
  },
  "iocs": {
    "file_hashes": [
      "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c",
      "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b"
    ],
    "delivery": [
      "Angler, Nuclear, and Sweet Orange exploit kits exploiting Adobe Flash Player vulnerabilities (CVE-2015-0311, CVE-2015-5119)",
      "Phishing emails with malicious zip archives containing JavaScript droppers"
    ],
    "persistence": [
      "Deletion of Windows Volume Shadow Copies using vssadmin.exe",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run autorun key creation"
    ]
  },
  "sources": [
    {
      "name": "ESET - Releases Decryptor for TeslaCrypt Ransomware",
      "url": "https://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-teslacrypt-ransomware/"
    },
    {
      "name": "Cisco Talos - Threat Spotlight: TeslaCrypt Master Key Released",
      "url": "https://blog.talosintelligence.com/"
    },
    {
      "name": "MITRE ATT&CK - TeslaCrypt",
      "url": "https://attack.mitre.org/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}