{
  "family": "troldesh",
  "sample_count": 14,
  "category": "ransomware",
  "description": "Troldesh (widely tracked across the intelligence community as Shade or Encrypter.JPHP) is a notorious Russian-speaking ransomware family first active in late 2014. Troldesh earned international attention for its idiosyncratic behavior: its ransom notes often contained Russian poetry and philosophical passages, and it cycled through numerous distinctive file extensions including `.crypted`, `.xtbl`, `.ytbl`, and `.breaking_bad`.\n\nTroldesh utilized AES-256 in CBC mode to encrypt victim data, protecting the key with asymmetric RSA-2048 encryption. In April 2020, the operators of Troldesh executed an extraordinary and voluntary exit: they published a public apology on GitHub and hacker forums ('We are the team which created a trojan-encryptor known as Shade, Troldesh... we made a decision to put an end to this story and to publish the rest of decryption keys'), releasing over 750,000 private decryption keys. Security vendors including Kaspersky Lab and Group-IB verified the keys and updated the free 'ShadeDecryptor' utility, allowing all remaining historical victims worldwide to recover their encrypted data free of charge.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Troldesh",
    "Shade",
    "Trojan.Troldesh",
    "Ransom.Shade",
    "Win32/Troldesh"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was Troldesh (Shade) ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Troldesh (also called Shade) was a prominent Russian ransomware active from 2014 to 2020 that encrypted files using AES-256 and RSA-2048."
      }
    },
    {
      "@type": "Question",
      "name": "How did Troldesh end in April 2020?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In April 2020, the authors published a public apology on GitHub and released over 750,000 decryption keys, allowing Kaspersky to create a free universal decryptor."
      }
    },
    {
      "@type": "Question",
      "name": "What file extensions did Troldesh append to encrypted files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Troldesh used extensions including .crypted, .xtbl, .ytbl, .breaking_bad, and .heisenberg."
      }
    },
    {
      "@type": "Question",
      "name": "How was Troldesh delivered to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Troldesh was primarily distributed through phishing emails with weaponized attachments and exploit kits leveraging Flash and Office vulnerabilities."
      }
    },
    {
      "@type": "Question",
      "name": "Is there a free decryptor available for Troldesh?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, Kaspersky's free ShadeDecryptor tool uses the authors' published 750,000 master keys to decrypt all versions of Troldesh."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1071.001",
    "T1566.001",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1090.003",
      "name": "Connection Proxy: Multi-hop Proxy (Tor)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Secondary Payloads)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to prevent the ransomware from enumerating and encrypting shared network drives (SMB shares) and to sever C2 communications.",
    "Do NOT pay the ransom. Navigate to the 'No More Ransom' project; a universal, free decryptor (Shade Decryptor by Kaspersky) is available for all variants of Troldesh.",
    "Use EDR or Process Explorer to terminate the active Troldesh encryption process before utilizing the decryptor.",
    "Perform a deep system scan after decryption, as Troldesh frequently downloaded secondary infostealers and botnet components."
  ],
  "what_to_avoid": [
    "Do not delete the encrypted files or the original ransom notes, as the free decryption tools often require information from the ransom note to identify the correct key.",
    "Avoid restarting the computer if the encryption process is actively running, as this can corrupt files currently being processed."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "lineage": {
    "derived_from": [],
    "variants": [
      "troldesh v1.0 (.crypted)",
      "troldesh v2.0 (.xtbl)",
      "troldesh v3.0 (.breaking_bad)",
      "encrypter.jphp (master key release)"
    ]
  },
  "attribution": [
    {
      "actor": "Shade / Troldesh Cybercrime Collective / April 2020 Public Master Key Release",
      "confidence": "high",
      "basis": "Active Russian cybercrime group from 2014 to 2020. In April 2020, the operators voluntarily terminated the project, issued a public apology, and released over 750,000 decryption keys on GitHub used by Kaspersky to decrypt all victims.",
      "source": "https://securelist.com/shade-ransomware-the-story-is-over/96884/"
    }
  ],
  "exploited_cves": [
    "CVE-2015-5119",
    "CVE-2017-0199"
  ],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "HTTPS",
      "Tor Onion Routing",
      "AES-256 with RSA-2048"
    ],
    "ports": [
      80,
      443
    ],
    "infrastructure": "Compromised WordPress websites acting as reverse proxies to Tor hidden services (.onion) for ransom communication; decommissioned voluntarily by the authors in April 2020."
  },
  "iocs": {
    "file_hashes": [
      "0ba91fcf3b2a3dbe16999be3a6c4b2de0a34fe9a42f36d8f5b40cf392bc6914c",
      "4de40ad749e7b2eb26d2466f10c66be91a134372a6b2cbdf7de0d6cfcf52240b"
    ],
    "delivery": [
      "Malicious email attachments disguised as financial invoices containing embedded macros or VBScript (CVE-2017-0199)",
      "Exploit kits delivering weaponized payloads via Adobe Flash vulnerabilities (CVE-2015-5119)"
    ],
    "persistence": [
      "Deletes Windows Volume Shadow Copies using vssadmin.exe",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run autorun key installation"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Securelist - Shade Ransomware: The Story is Over",
      "url": "https://securelist.com/shade-ransomware-the-story-is-over/96884/"
    },
    {
      "name": "Group-IB - Analysis of Shade / Troldesh Decryption Keys",
      "url": "https://www.group-ib.com/"
    },
    {
      "name": "MITRE ATT&CK - Shade",
      "url": "https://attack.mitre.org/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}