{
  "family": "tufik",
  "sample_count": 28,
  "category": "ransomware",
  "description": "Tufik (identified in security vendor catalogs under signatures including Ransom:Win32/Tufik, Trojan-Ransom.Win32.Tufik, and Trojan.Tufik) is a destructive crypto-ransomware family active since 2016. Infiltrating endpoints primarily through phishing email attachments, weaponized torrent downloads, and exploit kit drive-by compromise, Tufik executes rapid local discovery before traversing fixed drives, removable disks, and mounted network file shares. Tufik searches for user documents, spreadsheets, databases, source code files, and archives, encrypting them using a hybrid AES-256 and RSA-2048 cryptographic scheme and appending a custom identifier extension to affected files. Tufik executes vssadmin commands to purge Volume Shadow Copies, alters desktop background wallpapers, and drops ransom notes demanding cryptocurrency payments for data decryption.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Tufik",
    "Trojan-Ransom.Win32.Tufik",
    "Trojan.Tufik",
    "Win32/Tufik",
    "Ransom:Win32/Tufik.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Tufik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tufik is a crypto-ransomware family that locks documents and databases using AES-256 and demands cryptocurrency ransom for recovery."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tufik prevent victims from restoring shadow copies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes 'vssadmin delete shadows /all /quiet' and disables Windows startup recovery using bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What types of files are encrypted by Tufik?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets office documents, financial spreadsheets, databases, source code, archives, and multimedia files."
      }
    },
    {
      "@type": "Question",
      "name": "How is Tufik distributed across the Internet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads through phishing email attachments containing malicious macros, weaponized torrent files, and exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "What defenses are most effective against Tufik ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Maintain offline immutable backups, enable Controlled Folder Access in Microsoft Defender, and restrict execution of unauthorized scripts."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Documents",
    "Exploit Kit Drive-by Compromise",
    "Trojanized P2P Torrent Files"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "AES-256 / RSA-2048 File Encryption",
    "Volume Shadow Copy Purging (vssadmin)",
    "Network Share Traversal & Data Locking",
    "Desktop Wallpaper Extortion Display",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Ransom Note Text / HTML File"
    ],
    "network_signatures": [
      "HTTP/HTTPS POST requests transmitting victim system GUID and encrypted session keys to remote C2 infrastructure",
      "Tor-routed communications for payment verification"
    ],
    "evasion_techniques": [
      "Terminating database, backup, and antivirus processes using taskkill to release file locks",
      "Dynamic API resolution via PEB hash lookups to conceal cryptographic function calls"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "6ae9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TufikLocker",
      "HKCU\\Control Panel\\Desktop\\Wallpaper"
    ],
    "file_paths": [
      "%Temp%\\tufik.exe",
      "%Desktop%\\HOW_TO_DECRYPT_FILES.txt",
      "%AppData%\\Tufik\\key.dat"
    ]
  },
  "defensive_measures": [
    "Maintain immutable, air-gapped backups to ensure rapid data restoration without paying ransom demands",
    "Enable Controlled Folder Access in Microsoft Defender to protect documents from unauthorized encryption",
    "Enforce behavioral blocking rules against vssadmin delete shadows commands"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Tufik",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Tufik"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Tufik",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Tufik.A",
      "Ransom:Win32/Tufik.B"
    ]
  },
  "motivation": "Financial Extortion & Cryptocurrency Ransom Payments",
  "sample_hashes": []
}