MalwareUsed by 1 actorExploits 1 CVE

Mimic

Mimic is a Windows ransomware family first observed in June 2022. It encrypts local and network-accessible files, presents ransom demands, deletes shadow copies, terminates processes and services, and impairs recovery and security controls. Mimic uses Voidtools Everything search APIs to rapidly enumerate files selected for encryption and uses multithreaded execution to accelerate encryption. It can collect host information, enumerate network shares, conduct local-network discovery and port-scanning activity, establish Windows startup persistence, and remove artifacts after execution. Mimic incorporates code and design similarities associated with the leaked Conti ransomware builder. Variants, including Elpaco, provide configurable encryption scope, exclusions, ransom-note content, process termination, and command execution; analyzed variants use per-file asymmetric-key protection with ChaCha20-based encryption. Mimic has been deployed against poorly secured, internet-exposed Microsoft SQL Server environments following credential attacks, including campaigns attributed to the Trigona-related/Larva-26002 activity cluster and financially motivated operators assessed to have a Turkish nexus. The Pay2Key ransomware is based on Mimic.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2020-1472ZerologonExploited in the wild

After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).

via securelistsecurelist.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Larva-26002

In January 2024, the group first made its mark by deploying Trigona and Mimic ransomware on MS-SQL servers exposed to the internet with weak credentials.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

32 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.001PowerShellEvidence1

We developed the following YARA rules... $s1 = "powershell.exe -ExecutionPolicy Bypass"

T1059.003Windows Command ShellEvidence1

It is also possible to kill certain processes specified by the operator and execute system commands...

Persistence

2 techniques

T1112Modify RegistryEvidence1

The malware creates the following registry keys... Also, the artifact configures the Run registry key to execute svhostss.exe and display the ransom note at startup.

T1547.001Registry Run Keys / Startup FolderEvidence2

Mimic ransomware possesses a plethora of capabilities, including: Creating persistence via the RUN key.

Privilege Escalation

4 techniques

T1055Process InjectionEvidence1

In the GUI, the operator can select entire drives for encryption, perform a process injection to hide malicious processes...

T1068Exploitation for Privilege EscalationEvidence1

After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).

T1547.001Registry Run Keys / Startup FolderEvidence2

Mimic ransomware possesses a plethora of capabilities, including: Creating persistence via the RUN key.

T1548.002Bypass User Account ControlEvidence2

Mimic ransomware possesses a plethora of capabilities, including: Bypassing User Account Control (UAC).

Stealth

7 techniques

T1027.013Encrypted/Encoded FileEvidence1

Mimic arrives with a password-protected archive, disguised as Everything64.dll, which contains the ransomware payload.

T1036MasqueradingEvidence2

The password-protected archive is disguised as Everything64.dll, and the ransomware is renamed to bestplacetolive.exe after being copied to a random LocalAppData GUID directory.

T1055Process InjectionEvidence1

In the GUI, the operator can select entire drives for encryption, perform a process injection to hide malicious processes...

T1070Indicator RemovalEvidence1

Mimic copies dropped files to %LocalAppData%\{Random GUID}\, renames the ransomware, and deletes the original files from the %Temp% directory; its capabilities also include removing indicators.

T1070.004File DeletionEvidence1

The folder that is ultimately installed not only contains Mimic ransomware and the Everything tool, but also... the SDelete tool (xdel.exe) of Sysinternals.

T1140Deobfuscate/Decode Files or InformationEvidence1

Mimic drops a password-protected archive disguised as Everything64.dll and extracts it with 7za.exe using a hard-coded password.

T1564Hide ArtifactsEvidence1

Another feature of Elpaco is that it deletes itself after encrypting files to evade detection and analysis. The last step in malware execution is calling the Del command to delete all executables... before deleting, the sample uses the fsutil LOLBin... to securely erase svhostss.exe

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The malware creates the following registry keys... Also, the artifact configures the Run registry key to execute svhostss.exe and display the ransom note at startup.

Credential Access

2 techniques

T1110Brute ForceEvidence3

Attack targets are deemed to be poorly managed and externally exposed MS-SQL servers that have simple account credentials, rendering them vulnerable to brute force or dictionary attacks.

T1110.001Password GuessingEvidence1

Attack targets are deemed to be poorly managed and externally exposed MS-SQL servers that have simple account credentials, rendering them vulnerable to brute force or dictionary attacks.

Discovery

8 techniques

T1007System Service DiscoveryEvidence1

The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...

T1018Remote System DiscoveryEvidence1

For its net argument, Mimic uses GetIpNetTable to read the ARP cache and checks IP addresses in private network ranges before conducting Windows share enumeration.

T1033System Owner/User DiscoveryEvidence1

The commands that the threat actor first executes before creating the malware with BCP... are those that look up the infected system’s information as shown below. > hostname > whoami

T1046Network Service DiscoveryEvidence1

Mimic’s port-scanning functionality is based on the leaked Conti builder.

T1057Process DiscoveryEvidence1

The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...

T1082System Information DiscoveryEvidence2

Mimic ransomware possesses a plethora of capabilities, including: Collecting system information.

T1083File and Directory DiscoveryEvidence2

It abuses Everything32.dll by querying certain file extensions and filenames using Everything’s APIs to retrieve the file’s path for encryption.

T1135Network Share DiscoveryEvidence2

Mimic employs the NetShareEnum function to enumerate all shares on the gathered IP addresses.

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence1

The attackers were able to connect via RDP to the victim’s server after a successful brute force attack and then launch the ransomware.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

the threat actor most likely employed the method of saving their malware in a database and using BCP to create a local file from it.

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence4

Mimic retrieves target file paths for encryption, appends the .QUIETPLACE extension to encrypted files, and displays a ransom note.

T1489Service StopEvidence3

Mimic ransomware possesses a plethora of capabilities, including: Terminating processes and services.

T1490Inhibit System RecoveryEvidence2

Mimic is equipped with capabilities such as deleting shadow copies; its listed capabilities also include inhibiting system recovery.

Other

4 techniques

T1562.001Disable or Modify ToolsEvidence2

Mimic includes tools used for turning off Windows Defender and capabilities for disabling Windows Defender, disabling Windows telemetry, terminating processes and services, and activating anti-kill measures.

T1562Impair DefensesEvidence1

The folder that is ultimately installed not only contains Mimic ransomware and the Everything tool, but also the Defender Control tool (DC.exe) for deactivating Windows Defender

T1562.004Disable or Modify System FirewallEvidence1

Below are the TTPs identified from our malware analysis. Tactic Technique ID ... Defense evasion Disable or Modify System Firewall T1562.004

T1562.009Safe Mode BootEvidence1

there is evidence of safe mode being utilized... The launcher registers itself as a service... to allow itself to be run in safe mode... When the process is complete, it deactivates the safe mode option

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app6 months ago

hash.md5●●●●●●●●●●●●View more in app6 months ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

13 SOURCESView more in app

trendai security blogNews

Aug 31, 2026

New Mimic Ransomware Abuses Everything APIs for its Encryption Process | TrendAI (US)

Windows ransomware that uses multithreaded encryption and abuses the legitimate Everything filename-search APIs to efficiently enumerate target files. It appends the .QUIETPLACE extension to encrypted files, displays a ransom note, can disable Windows Defender and telemetry, establish Run-key persistence, bypass UAC, inhibit recovery, remove indicators, terminate processes and services, and enumerate network shares.

securonix blogNews

Jul 26, 2026

Securonix Threat Research Security Advisory: New RE#TURGENCE Attack Campaign: Turkish Hackers Target MSSQL Servers to Deliver Domain-Wide MIMIC Ransomware - Securonix

Ransomware manually deployed after MSSQL server compromise and lateral movement. In this campaign it was delivered as red25.exe, which extracted red.exe, used the legitimate Everything utility to locate files, encrypted hosts including the MSSQL server and domain controller, and dropped a ransom note.

gurucul threat researchNews

Jul 14, 2026

ClickFix: Exploiting Compromised WordPress Sites with a Polygon-Based C2 Infrastructure | Community Portal | Gurucul

Mimic5

xakepNews

May 28, 2026

Группировка Fluffy Wolf атаковала российские компании новой малварью - Хакер

Семейство вымогательского ПО, на котором основан Pay2Key.

+8 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping32

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Mimic