{
  "family": "tonmye",
  "sample_count": 21,
  "category": "ransomware",
  "description": "Tonmye (tracked across antimalware research as Ransom:Win32/Tonmye, Trojan-Ransom.Win32.Tonmye, and Win32/Tonmye) is a destructive crypto-ransomware family targeting Windows systems. Infiltrating endpoints through malicious phishing email attachments, exploit kits, and compromised software repacks, Tonmye initiates system discovery upon execution. It terminates database management engines, productivity applications, and backup software using command-line taskkill to unlock open files. Tonmye enumerates local hard drives, removable USB storage, and connected network shares, encrypting documents, databases, archives, and multimedia files using AES-256 encryption wrapped with an embedded RSA public key. To impede file restoration, Tonmye executes shell commands invoking vssadmin to delete Volume Shadow Copies and uses bcdedit to disable automatic startup recovery, before displaying desktop extortion instructions demanding cryptocurrency payment.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Tonmye",
    "Trojan-Ransom.Win32.Tonmye",
    "Win32/Tonmye",
    "Ransom.Tonmye",
    "Ransom:Win32/Tonmye.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Tonmye?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tonmye is a crypto-ransomware family that encrypts files on Windows devices and demands cryptocurrency ransom for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tonmye disable Windows backup mechanisms?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet to purge Volume Shadow Copies and disables startup recovery via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are encrypted by Tonmye?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It encrypts office documents, financial spreadsheets, databases, media files, and system backup archives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tonmye spread to target endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via spearphishing emails with malicious attachments, weaponized macros, and drive-by web exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended recovery procedure for Tonmye?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the network, terminate active ransomware processes, and restore encrypted files from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Tonmye",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Tonmye"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Tonmye",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_tonmye"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Tonmye",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Tonmye"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately sever the network connection of affected hosts to halt encryption across shared network drives.",
    "Kill active ransomware processes via Windows Task Manager or elevated PowerShell commands.",
    "Preserve forensic memory dumps and sample files for threat intelligence and IOC documentation.",
    "Block malicious delivery domains and sender email addresses at perimeter firewalls.",
    "Rebuild compromised endpoints from verified clean master images and restore data from offline backups."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency extortion demand; payment does not guarantee decryption key recovery.",
    "Do not reboot systems before securing volatile forensic memory data."
  ],
  "target_industries": [
    "Healthcare",
    "Manufacturing",
    "Commercial Enterprises",
    "Retail"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}