{
  "family": "vabushky",
  "sample_count": 32,
  "category": "ransomware",
  "description": "Vabushky (cataloged across security vendor databases and threat intelligence feeds under signatures including Ransom:Win32/Vabushky, Trojan-Ransom.Win32.Vabushky, and Trojan.Vabushky) is a destructive crypto-ransomware and extortion screen-locker threat active since 2016. Infiltrating endpoints primarily through malicious spam email attachments containing macro-enabled documents or exploit kit redirections, Vabushky immediately initiates destructive host operations. It terminates active database, backup, and security services before traversing local drives, removable disks, and mapped network shares. Vabushky encrypts user documents, spreadsheets, images, and archives using AES-256 with an embedded RSA public key, appending a custom identifier extension to locked files. Furthermore, it deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), disables Windows Startup Repair (bcdedit /set {default} recoveryenabled No), and presents an extortion lockscreen warning demanding cryptocurrency payment for file restoration.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Vabushky",
    "Trojan-Ransom.Win32.Vabushky",
    "Trojan.Vabushky",
    "Win32/Vabushky",
    "Ransom:Win32/Vabushky.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Vabushky?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vabushky is a crypto-ransomware family that encrypts user documents with AES-256 and displays an extortion lockscreen demanding cryptocurrency payment."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vabushky prevent victims from restoring files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin to delete all Volume Shadow Copies and uses bcdedit to disable Windows automated startup recovery."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are targeted by Vabushky?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets personal documents, spreadsheets, financial databases, source code archives, and multimedia files across local and network drives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vabushky spread to computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious spam email attachments, compromised websites via exploit kits, and exposed Remote Desktop Protocol (RDP) connections."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against Vabushky ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Maintain offline and immutable backups, disable SMBv1 and open RDP ports, enable Controlled Folder Access in Windows Defender, and enforce multi-factor authentication."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Documents",
    "Exploit Kit Drive-by Downloads",
    "RDP Brute-Force Attacks"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "AES-256 / RSA-2048 File Encryption",
    "Volume Shadow Copy Deletion (vssadmin)",
    "Windows Startup Recovery Disablement (bcdedit)",
    "Network Share Traversal & Data Locking",
    "Extortion Lockscreen Display"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Ransom Note Text / HTML File"
    ],
    "network_signatures": [
      "HTTP/HTTPS POST requests transmitting victim system UID and generated encryption session keys to remote C2 servers",
      "Tor-routed payment portal communications for ransom negotiation"
    ],
    "evasion_techniques": [
      "Terminating endpoint security and backup software processes via taskkill",
      "Dynamic API resolution through PEB hash lookups to foil static import detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0",
      "e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VabushkyLocker",
      "HKCU\\Software\\Vabushky"
    ],
    "file_paths": [
      "%Temp%\\vabushky.exe",
      "%Desktop%\\HOW_TO_RESTORE_FILES.txt",
      "%AppData%\\Vabushky\\lock.key"
    ]
  },
  "defensive_measures": [
    "Enable Controlled Folder Access in Microsoft Defender to protect key document directories from unauthorized modification",
    "Enforce strict behavioral blocking for vssadmin and bcdedit invocations originating from non-administrative parent processes",
    "Maintain immutable, air-gapped backups to guarantee recovery without paying ransom demands"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Vabushky",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Vabushky"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Vabushky",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Vabushky.A",
      "Ransom:Win32/Vabushky.B"
    ]
  },
  "motivation": "Financial Extortion & Cryptocurrency Ransom Payments",
  "sample_hashes": []
}