DEATHRANSOM

Description

DEATHRANSOM is a ransomware variant that first circulated as scareware, claiming to encrypt files that it had not touched, before its operators added genuine encryption in later builds. It spreads through spam emails and compromised remote services, and it drops ransom notes demanding payment from Windows users. The family's shift from fake to real encryption shows how quickly criminal operators iterate when early versions fail to generate revenue.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

DeathRansomDeathransom

MITRE ATT&CK techniques

9 techniques across 4 tactics.

TA0002 Execution

T1047Windows Management Instrumentation

TA0007 Discovery

T1083File and Directory Discovery
T1135Network Share Discovery
T1614System Location Discovery
- T1614.001System Language Discovery
T1680Local Storage Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0040 Impact

T1486Data Encrypted for Impact
T1490Inhibit System Recovery

Alert name variants

Alert Name	Engine
Binary.Ransomware.DeathRansom	ATP Sandbox Adv. Heuristics
Gen:Variant.Ransom.Deathransom.13	AV
Gen:Variant.Ransom.Deathransom.14	AV
Gen:Variant.Ransom.Deathransom.16	AV
Gen:Variant.Ransom.DeathRansom.28	AV
Gen:Variant.Ransom.DeathRansom.3	AV
Gen:Variant.Ransom.DeathRansom.5	AV
Gen:Variant.Ransom.DeathRansom.7	AV
Trojan.Ransom.DeathRansom.A	AV
Trojan.Ransom.Deathransom.B	AV
Win32.Ransomware.Deathransom	ATP Sandbox Adv. Heuristics
Win32.Ransomware.DeathRansom	ATP Sandbox Adv. Heuristics
Win32.Trojan.Deathransom	ATP Sandbox Adv. Heuristics

Related families

REvil BlackCat DarkGate Avaddon Bazar