{
  "family": "vools",
  "sample_count": 16,
  "category": "ransomware",
  "description": "Vools (classified across antimalware research as Ransom:Win32/Vools, Trojan-Ransom.Win32.Vools, and Win32/Vools) is a high-speed corporate crypto-ransomware family designed for rapid and disruptive enterprise extortion. Distributed via phishing emails with malicious document loaders and compromised external remote desktop endpoints, Vools initiates by terminating database and email services (such as MSSQL, MySQL, and Exchange) to prevent file-locking conflicts. The ransomware then executes an aggressive multi-threaded encryption routine across all connected fixed drives, removable media, and SMB network shares. Utilizing symmetric AES-256 encryption in CBC mode, Vools prepends custom identifier headers and appends .vools to encrypted files. It places ransom notes titled RESTORE_VOOLS_FILES.html across all processed directories, demanding Bitcoin payment for file restoration while executing commands to purge Volume Shadow Copies, wipe system state backups, and disable Windows Recovery Environment.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Vools",
    "Trojan-Ransom.Win32.Vools",
    "Win32/Vools",
    "Vools Ransomware",
    "Ransom.Vools"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Vools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vools is an enterprise crypto-ransomware family that encrypts corporate workstations and network shares using AES-256."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Vools terminate database and email processes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminating these processes releases file locks, allowing Vools to encrypt live databases and mail stores without errors."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vools target network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enumerates local network interfaces and Server Message Block (SMB) connections, encrypting shared departmental files."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vools prevent system recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin delete shadows /all /quiet and clears Windows recovery options via bcdedit."
      }
    },
    {
      "@type": "Question",
      "name": "What should organizations do when encountering Vools ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the compromised network segment immediately, collect memory dumps and sample binaries, and restore data from offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1562.001",
    "T1490",
    "T1083",
    "T1135",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Vools from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Vools persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Vools attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Vools modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Vools dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Vools",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Vools"
    },
    {
      "name": "Sophos Threat Center - Ransom_Vools Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Ransom-Vools"
    },
    {
      "name": "MITRE ATT&CK - Data Encrypted for Impact (T1486)",
      "url": "https://attack.mitre.org/techniques/T1486/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}