{
  "family": "vehidis",
  "sample_count": 15,
  "category": "ransomware",
  "description": "Vehidis (classified as Ransom:Win32/Vehidis and Trojan-Ransom.Win32.Vehidis) is a destructive crypto-ransomware family designed for rapid and wide-scale data extortion. Infiltrating endpoints through malvertising networks, malicious software bundles, and phishing lures, Vehidis terminates active database and productivity applications to ensure uninterrupted file access. It executes an asynchronous multi-threaded encryption routine that leverages AES-256 in CBC mode, appending .vehidis to encrypted files. Vehidis drops ransom notes titled RESTORE_VEHIDIS_FILES.html on the desktop and within every processed directory, demanding cryptocurrency payment for file restoration while wiping Volume Shadow Copies and system restore points.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Vehidis",
    "Trojan-Ransom.Win32.Vehidis",
    "Win32/Vehidis",
    "Vehidis Ransomware",
    "Ransom.Vehidis"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Vehidis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vehidis is a crypto-ransomware family that encrypts files on Windows workstations and servers using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vehidis ensure files are accessible for encryption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It terminates open database, office productivity, and backup processes before beginning the encryption routine."
      }
    },
    {
      "@type": "Question",
      "name": "Does Vehidis encrypt files across mapped network drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it discovers and encrypts files on all connected local drives and SMB network shares."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vehidis obstruct system recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to purge Volume Shadow Copies and disables Windows automatic repair."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended recovery method for Vehidis victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected endpoint from the network, document ransom indicators, and restore affected files from backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Vehidis from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Vehidis persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Vehidis attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Vehidis modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Vehidis dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Vehidis",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Vehidis"
    },
    {
      "name": "Sophos Threat Center - Ransom_Vehidis Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Ransom-Vehidis"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}