{
  "family": "truew",
  "sample_count": 19,
  "category": "ransomware",
  "description": "Truew (documented across antimalware signatures as Ransom:Win32/Truew, Trojan-Ransom.Win32.Truew, and Ransom.Truew) is a targeted Windows crypto-ransomware family designed for rapid local storage and network share encryption. Propagated through weaponized email phishing lures, software bundling aggregators, and compromised remote access credentials, Truew executes extensive system pre-encryption checks upon launch. It queries connected disk drives, enumerates accessible SMB network shares, and disables system recovery mechanisms by invoking vssadmin to delete volume shadow copies and executing bcdedit commands to disable Windows startup recovery options ('bcdedit /set {default} bootstatuspolicy ignoreallfailures' and 'bcdedit /set {default} recoveryenabled no'). Truew encrypts user documents, archives, databases, and media files using a hybrid cryptographic scheme combining AES-256 with an embedded RSA public key. Encrypted files are renamed with a unique victim identifier and the '.truew' extension. Truew generates ransom demand notes ('RECOVERY_INFO.txt') in all processed directories and modifies the user desktop wallpaper via SystemParametersInfo to display ransom instructions.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Truew",
    "Trojan-Ransom.Win32.Truew",
    "Win32/Truew",
    "Ransom.Truew",
    "Truew Ransomware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Truew?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Truew is a Windows crypto-ransomware family that encrypts local drives and network shares using AES-256 and RSA cryptography."
      }
    },
    {
      "@type": "Question",
      "name": "How does Truew disable Windows system recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin to purge shadow copies and alters bcdedit configuration to suppress automatic recovery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Truew identify files to encrypt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It traverses local logical drives and network shares, targeting documents, databases, archives, and photos while skipping core Windows OS binaries."
      }
    },
    {
      "@type": "Question",
      "name": "How is Truew delivered to victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious email attachments, Trojanized utility downloads, and compromised remote desktop connections."
      }
    },
    {
      "@type": "Question",
      "name": "How should organizations respond to a Truew infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect infected endpoints from the local network, preserve memory dumps, report the incident, and restore files from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1491.001",
    "T1083",
    "T1124"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Weaponized Loaders",
    "Compromised Remote Desktop Protocol (RDP)",
    "Malicious Software Bundles"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Hybrid Cryptography (AES-256 + RSA)",
    "Volume Shadow Copy & Boot Recovery Deletion",
    "Local Disk & Network Share Traversal",
    "Desktop Wallpaper Modification via SystemParametersInfo",
    "Automated Ransom Note Placement"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound HTTP/HTTPS traffic to remote C2 reporting victim ID and encryption metrics",
      "SMB network scanning traffic to map open administrative shares"
    ],
    "evasion_techniques": [
      "Dynamic import resolution to conceal cryptographic and file system APIs",
      "Code obfuscation to defeat heuristic antivirus scanners"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d",
      "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TruewLocker"
    ],
    "file_paths": [
      "%AppData%\\Truew\\truew.exe",
      "C:\\RECOVERY_INFO.txt"
    ]
  },
  "defensive_measures": [
    "Implement network segmentation and restrict SMB access across internal workstation subnets",
    "Maintain immutable, write-once backups to facilitate complete recovery without paying ransoms",
    "Enforce endpoint detection and response (EDR) rules detecting execution of bcdedit and vssadmin"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Truew",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Truew"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Truew",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Truew.A",
      "Ransom:Win32/Truew.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": []
}