T1486: Data Encrypted for Impact

ATT&CK Mapping

Field	Value
Technique ID	T1486
Name	Data Encrypted for Impact
Tactic	Impact (impact)
Platforms	ESXi, IaaS, Linux, macOS, Windows
Sub-technique	No

Why it matters

In the OpenTrojan knowledge graph, Data Encrypted for Impact (T1486) is one of the highest-connectivity ATT&CK techniques: 85 MITRE STIX relationships reference this technique; 19 threat groups observed using it; 62 software families associated; 4 campaigns associated; 7 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1486). Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted. In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR. Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors. To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares. Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as “print bombing”). In cloud environments, storage objects within compromised accounts may also be encrypted. For example, in AWS environments, adversaries may leverage services such as AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data.

Detection

DET0215 Detection of Multi-Platform File Encryption for Impact AN0602 High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell. AN0603 Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops. AN0604 Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using srm , gpg , or compiled payloads. Often correlated with ransom note creation in multiple directories. AN0605 Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through dcui , SSH, or vSphere. AN0606 Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.

Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1486).

Mitigation

Data Backup involves taking and securely storing backups of data from end-user systems and critical servers. It ensures that data remains available in the event of system compromise, ransomware attacks, or other disruptions. Backup processes should include hardening backup systems, implementing secure storage solutions, and keeping backups isolated from the corporate network to prevent compromise during active incidents. This mitigation can be implemented through the following measures:

Regular Backup Scheduling:

• Use Case: Ensure timely and consistent backups of critical data.
• Implementation: Schedule daily incremental backups and weekly full backups for all critical servers and systems.

Immutable Backups:

• Use Case: Protect backups from modification or deletion, even by attackers.
• Implementation: Use write-once-read-many (WORM) storage for backups, preventing ransomware from encrypting or deleting backup files.

Backup Encryption:

• Use Case: Protect data integrity and confidentiality during transit and storage.
• Implementation: Encrypt backups using strong encryption protocols (e.g., AES-256) before storing them in local, cloud, or remote locations.

Offsite Backup Storage:

• Use Case: Ensure data availability during physical disasters or onsite breaches.
• Implementation: Use cloud-based solutions like AWS S3, Azure Backup, or physical offsite storage to maintain a copy of critical data.

Backup Testing:

• Use Case: Validate backup integrity and ensure recoverability.
• Implementation: Regularly test data restoration processes to ensure that backups are not corrupted and can be recovered quickly.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

Related Software

• EKANS
• SynAck
• AvosLocker
• RobbinHood
• RansomHub
• Prestige
• Playcrypt
• Medusa Ransomware
• Bad Rabbit
• ShrinkLocker
• BlackByte 2.0 Ransomware
• WastedLocker

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

Related Threat Groups

• APT38
• Indrik Spider
• BlackByte
• APT41
• Storm-1811
• FIN7
• Sandworm Team
• Scattered Spider
• Akira
• Storm-0501
• TA505
• Medusa Group

Group associations are from MITRE ATT&CK STIX relationships.

Related Campaigns

• SharePoint ToolShell Exploitation
• C0018
• C0015
• HomeLand Justice

Campaign associations are from MITRE ATT&CK STIX relationships.

Related Content

• Cadet Blizzard
• FIN12
• Indrik Spider
• LockBit Ransomware Operation
• menuPass
• Moses Staff

References

• https://attack.mitre.org/techniques/T1486
• https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware
• https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html
• https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector
• https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c
• https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire
• https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers
• https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary
• https://www.us-cert.gov/ncas/alerts/TA16-091A
• https://www.us-cert.gov/ncas/alerts/TA17-181A
• https://www.us-cert.gov/ncas/alerts/AA18-337A