{
  "family": "wdjiange",
  "sample_count": 20,
  "category": "ransomware",
  "description": "Wdjiange (classified in threat research telemetry under signatures Ransom:Win32/Wdjiange, Trojan-Ransom.Win32.Wdjiange, and Win32/Wdjiange) is an aggressive Windows ransomware family active in opportunistic and targeted extortion campaigns. Delivered via malicious spam attachments, cracked software utilities, and exploit kits, Wdjiange verifies administrative execution privileges before enumerating local disk partitions, external media, and SMB network shares. It encrypts targeted data files—including documents, databases, code repositories, and archives—using AES-256 encryption wrapped with an asymmetric public key. Wdjiange deletes Volume Shadow Copies via vssadmin, modifies boot configurations using bcdedit to prevent recovery, and deposits extortion notes demanding cryptocurrency payment for a decryption tool.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Wdjiange",
    "Trojan-Ransom.Win32.Wdjiange",
    "Win32/Wdjiange",
    "Ransom.Wdjiange",
    "Ransom:Win32/Wdjiange.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Wdjiange?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Wdjiange is a crypto-ransomware family targeting Windows devices, encrypting files and demanding cryptocurrency payment."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wdjiange prevent shadow copy recovery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes vssadmin commands to silently delete all Volume Shadow Copies and uses bcdedit to disable automated repair."
      }
    },
    {
      "@type": "Question",
      "name": "What storage locations are targeted by Wdjiange?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets local hard disks, external USB drives, and accessible SMB network shares."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wdjiange enter target environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enters via spearphishing emails with malicious attachments, weaponized macros, and compromised software repacks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended recovery steps for Wdjiange ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the network, disinfect affected machines, and restore encrypted files from verified offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1566.001",
    "T1083",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Wdjiange",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wdjiange"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Wdjiange",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_wdjiange"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan-Ransom.Win32.Wdjiange",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Ransom.Win32.Wdjiange"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Disconnect the affected endpoint from LAN, WAN, and Wi-Fi networks immediately to stop encryption spreading.",
    "Kill active ransomware processes via Windows Task Manager or elevated PowerShell commands.",
    "Capture volatile physical memory and file samples for cryptographic inspection.",
    "Block delivery domains and malicious sender email addresses at perimeter security gateways.",
    "Reimage compromised workstations and restore business data from immutable offline backups."
  ],
  "what_to_avoid": [
    "Do not pay the cryptocurrency extortion fee, as it does not guarantee decryption key recovery.",
    "Do not connect clean backup drives to the infected system before confirming complete remediation."
  ],
  "target_industries": [
    "Education",
    "Healthcare",
    "Manufacturing",
    "Commercial Enterprises"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Financially Motivated Ransomware Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Ransom Payments",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}