{
  "family": "vemply",
  "sample_count": 26,
  "category": "ransomware",
  "description": "Vemply (identified across antimalware research telemetry under signatures including Ransom:Win32/Vemply, Trojan-Ransom.Win32.Vemply, and Trojan.Vemply) is a crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through phishing email campaigns containing weaponized office documents and exploit kit redirections, Vemply initiates rapid host reconnaissance upon execution. It terminates database, backup, and antimalware processes via taskkill, releasing open file locks across local drives and network shares. Vemply traverses directory trees, encrypting documents, spreadsheets, databases, source code, and archives using AES-256 with an embedded RSA public key. It executes vssadmin commands to purge Volume Shadow Copies, modifies desktop wallpaper to display an extortion notice, and demands cryptocurrency payment in exchange for a decryption utility.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Vemply",
    "Trojan-Ransom.Win32.Vemply",
    "Trojan.Vemply",
    "Win32/Vemply",
    "Ransom:Win32/Vemply.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Vemply?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vemply is a crypto-ransomware family that encrypts personal documents with AES-256 and demands cryptocurrency ransom for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vemply disable Windows recovery options?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin to purge Volume Shadow Copies and disables Windows automated startup recovery using bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What file types are encrypted by Vemply?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets business spreadsheets, documents, databases, developer source code, archives, and multimedia files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vemply spread into computer systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via malicious email attachments containing weaponized macros, compromised software downloads, and exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "What defense effectively protects against Vemply ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Maintain offline immutable backups, enable Controlled Folder Access in Microsoft Defender, and enforce strict execution policies."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Macro-Enabled Documents",
    "Exploit Kit Drive-by Compromise",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "AES-256 / RSA-2048 File Encryption",
    "Volume Shadow Copy Purging (vssadmin)",
    "Network Share Traversal & Data Locking",
    "Desktop Wallpaper Extortion Display",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Ransom Note Text / HTML File"
    ],
    "network_signatures": [
      "HTTP/HTTPS POST requests transmitting victim system GUID and generated encryption session keys to remote C2 servers",
      "Tor-routed payment portal communications for ransom negotiation"
    ],
    "evasion_techniques": [
      "Killing database and backup software processes via taskkill prior to encryption",
      "Dynamic API resolution through PEB hash lookups to conceal cryptographic API calls"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9ce0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8",
      "adf1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VemplyLocker",
      "HKCU\\Control Panel\\Desktop\\Wallpaper"
    ],
    "file_paths": [
      "%Temp%\\vemply.exe",
      "%Desktop%\\HOW_TO_RESTORE_FILES.txt",
      "%AppData%\\Vemply\\keys.dat"
    ]
  },
  "defensive_measures": [
    "Implement automated, air-gapped backups to ensure full recovery capability without ransom payments",
    "Enable Controlled Folder Access in Microsoft Defender to safeguard critical document repositories",
    "Block command-line invocations of vssadmin delete shadows using endpoint behavioral detection rules"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Vemply",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Vemply"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Vemply",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Vemply.A",
      "Ransom:Win32/Vemply.B"
    ]
  },
  "motivation": "Financial Extortion & Cryptocurrency Ransom Payments",
  "sample_hashes": []
}