Gatak

Overview

Trojan:Win32/Gatak (also tracked by Symantec as Trojan.Zbot/Gatak and sometimes functioning as ransomware) is a highly sophisticated malware family infamous for its targeted attacks on the **healthcare sector**. It is primarily distributed through 'watering hole' attacks on websites offering pirated software and keygens. Once inside a network, Gatak acts as an advanced backdoor, allowing attackers to perform reconnaissance, steal sensitive patient data (PHI), and potentially deploy ransomware across the hospital network.

Understanding Gatak (Healthcare Targeting)
To an end-user, the initial infection usually occurs when trying to install a cracked software application. For a hospital SOC, a Gatak infection is a 'Code Red' incident. Gatak actors are known for their patience; they will spend weeks mapping the internal network, identifying critical servers housing electronic health records (EHR), and escalating privileges before taking destructive action.

Execution and Evasion Strategies
Gatak is distributed when a user downloads and executes a malicious software keygen (`T1204.002`). The malware is heavily obfuscated and uses steganography to hide its C2 configuration data within seemingly benign image files (`T1027.003`). Upon execution, it achieves persistence (`T1547.001`) and begins extensive network discovery (`T1046`, `T1016`). It uses advanced process injection techniques to blend in with legitimate system processes (`T1055`). The backdoor allows the attackers to deploy secondary modules, such as credential dumpers (`T1003`) and data exfiltration tools (`T1048`), specifically searching for databases and medical imaging files.

Indicators of Compromise & Impact
The impact can be catastrophic, leading to massive HIPAA violations, compromised patient care, and full network encryption if ransomware is dropped. Host-based IoCs include EDR alerts for suspicious child processes spawning from downloaded keygens or cracking tools, and unusual registry modifications. Network IoCs include beaconing to known Gatak C2 infrastructure and anomalous lateral movement (SMB/RDP) originating from a non-administrative workstation.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_GATAK_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gatak"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "gatak" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Gatak (Ransomware) Execution & Triage
id: 08f6ec1c-8cc2-56c5-a174-d568dda79cae
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Gatak malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/gatak
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1027_003
- attack.t1055
- attack.t1046
- attack.t1204_002
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_GATAK_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gatak tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "gatak" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the infected endpoint, especially if it resides on a network segment with access to patient databases (EHR) or medical devices.
2. Conduct a massive hunt across the enterprise for pirated software or keygens, as this is the primary entry vector for Gatak.
3. Assume domain credentials have been compromised if Gatak has been active on the network; initiate password resets for all affected users.
4. Perform deep network forensic analysis to determine if patient health information (PHI) was exfiltrated to the attacker's C2 servers.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is isolated to a single user downloading a cracked game; Gatak actors are highly skilled at lateral movement and actively seek out critical healthcare infrastructure.
2. Avoid relying solely on signature-based AV, as Gatak heavily obfuscates its payloads and uses fileless techniques.

References & External Analysis

• Search "gatak" on VirusTotal (External Analysis)
• Search "gatak" on Any.Run (Sandbox Sandbox)
• Search "gatak" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Retribution
• Rzwaagpbkfii
• Myransom
• Ezsoftwareupdater
• Tgrandongc
• Krakencryptor
• Resod
• Flawedammyy

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/gatak.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.