Netwalker

ATP Sandbox Adv. HeuristicsAV

Description

Netwalker is fileless ransomware written in PowerShell and executed directly in memory.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

NetWalker

MITRE ATT&CK techniques

18 techniques across 7 tactics.

TA0002 Execution

T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.001PowerShell
T1106Native API
T1569System Services
- T1569.002Service Execution

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.010Command Obfuscation
- T1027.009Embedded Payloads
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

T1082System Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0008 Lateral Movement

T1570Lateral Tool Transfer

TA0011 Command and Control

T1105Ingress Tool Transfer

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery

TA0112 Defense Impairment

T1112Modify Registry
T1685Disable or Modify Tools

Alert name variants

Alert Name	Engine
Gen:Variant.Ransom.Netwalker.1	AV
Gen:Variant.Ransom.NetWalker.30	AV
Gen:Variant.Ransom.NetWalker.39	AV
Gen:Variant.Ransom.Netwalker.4	AV
Gen:Variant.Ransom.NetWalker.53	AV
Gen:Variant.Ransom.NetWalker.54	AV
Gen:Variant.Ransom.Netwalker.6	AV
Gen:Variant.Ransom.NetWalker.60	AV
Generic.Ransom.Netwalker.876CBD20	AV
Script-PowerShell.Ransomware.Netwalker	ATP Sandbox Adv. Heuristics
Script-PowerShell.Ransomware.NetWalker	ATP Sandbox Adv. Heuristics
Trojan.Ransom.Netwalker.A	AV
Win32.Ransomware.Netwalker	ATP Sandbox Adv. Heuristics
Win32.Ransomware.NetWalker	ATP Sandbox Adv. Heuristics
Win64.Ransomware.NetWalker	ATP Sandbox Adv. Heuristics

Related blogs

Netskope Threat Coverage: LockBit’s Ransomware Builder Leaked

Netskope Threat Coverage: LockBit’s Ransomware Builder Leaked

September 26, 20225 min read

Related families

REvil DarkGate Qilin QakBot Cobalt Strike

References