MalwareRansomwareUsed by 1 actorExploits 1 CVE

Mimic

Mimic is a Windows ransomware family derived from the leaked Conti codebase. It is designed to enumerate files, encrypt victim data, and present ransom instructions, and has been observed in multiple variants including Elpaco as well as derivative operations such as Pay2Key builds based on Mimic. A notable implementation detail is its abuse of the legitimate Voidtools Everything search components and APIs to accelerate filesystem discovery and identify files for encryption. Reported variants also support multi-threaded encryption, configurable targeting and exclusions, process and service termination to unlock files, and operator-controlled customization through a graphical interface.

Observed Mimic variants use modern file-encryption workflows, including per-file asymmetric key exchange with X25519 or Curve25519 and symmetric encryption with ChaCha20, with session state preserved to allow interrupted encryption runs to resume. Some builds establish persistence through Windows startup mechanisms and file-association changes that ensure ransom notes are displayed after reboot. Defense evasion has included disabling Microsoft Defender with third-party utilities, packaging payloads in self-extracting or password-protected archives, and deleting artifacts after execution.

Mimic has been deployed following brute-force compromise of exposed services, especially RDP and internet-facing Microsoft SQL Server instances with weak credentials. In documented intrusions, attackers used post-compromise tooling such as Impacket, remote administration software, and SQL Server utilities to stage payloads and maintain access before launching ransomware. Activity involving Mimic has been linked to financially motivated operators and affiliates, including campaigns associated with Trigona-related MS-SQL intrusions and later ransomware operations built on Mimic code. Victims have included organizations across multiple countries and sectors, with repeated targeting of Windows servers and enterprise environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2020-1472ZeroLogonExploited in the wild

After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).

via securelistsecurelist.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Larva-26002

In January 2024, the group first made its mark by deploying Trigona and Mimic ransomware on MS-SQL servers exposed to the internet with weak credentials.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.001PowerShellEvidence1

We developed the following YARA rules... $s1 = "powershell.exe -ExecutionPolicy Bypass"

T1059.003Windows Command ShellEvidence1

It is also possible to kill certain processes specified by the operator and execute system commands...

Persistence

2 techniques

T1112Modify RegistryEvidence1

The malware creates the following registry keys... Also, the artifact configures the Run registry key to execute svhostss.exe and display the ransom note at startup.

T1547.001Registry Run Keys / Startup FolderEvidence1

Also, the artifact configures the Run registry key to execute svhostss.exe and display the ransom note at startup.

Privilege Escalation

4 techniques

T1055Process InjectionEvidence1

In the GUI, the operator can select entire drives for encryption, perform a process injection to hide malicious processes...

T1068Exploitation for Privilege EscalationEvidence1

After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).

T1547.001Registry Run Keys / Startup FolderEvidence1

Also, the artifact configures the Run registry key to execute svhostss.exe and display the ransom note at startup.

T1548.002Bypass User Account ControlEvidence1

Below are the TTPs identified from our malware analysis. Tactic Technique ID ... Defense evasion Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002

Stealth

3 techniques

T1036MasqueradingEvidence1

The most interesting artifact is svhostss.exe, which is the main console used by the malware. It is worth mentioning that this name closely mimics svchost.exe, a legitimate Windows process.

T1055Process InjectionEvidence1

In the GUI, the operator can select entire drives for encryption, perform a process injection to hide malicious processes...

T1564Hide ArtifactsEvidence1

Another feature of Elpaco is that it deletes itself after encrypting files to evade detection and analysis. The last step in malware execution is calling the Del command to delete all executables... before deleting, the sample uses the fsutil LOLBin... to securely erase svhostss.exe

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The malware creates the following registry keys... Also, the artifact configures the Run registry key to execute svhostss.exe and display the ransom note at startup.

Credential Access

1 technique

T1110Brute ForceEvidence2

The attackers were able to connect via RDP to the victim’s server after a successful brute force attack and then launch the ransomware.

Discovery

4 techniques

T1007System Service DiscoveryEvidence1

The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...

T1057Process DiscoveryEvidence1

The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...

T1083File and Directory DiscoveryEvidence1

The encryptor builds on Mimic ransomware, a Conti derivative that uses voidtools Everything for filesystem enumeration.

T1135Network Share DiscoveryEvidence1

The console interface, running alongside the GUI, gathers detailed information about the system, including drives and file shares.

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence1

The attackers were able to connect via RDP to the victim’s server after a successful brute force attack and then launch the ransomware.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Malware is then created using the BCP utility, which exports a malicious binary from the database table uGnzBdZbsi to a local path as api.exe... In systems where BCP fails, the malware is fetched using Curl or Bitsadmin via PowerShell.

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence2

The Mimic ransomware searches for specific files using Everything APIs, encrypts user data... In the GUI, the operator can select entire drives for encryption...

T1489Service StopEvidence2

Below are the TTPs identified from our malware analysis. Tactic Technique ID ... Impact Service Stop T1489

T1490Inhibit System RecoveryEvidence1

Below are the TTPs identified from our malware analysis. Tactic Technique ID ... Impact Inhibit System Recovery T1490

Other

2 techniques

T1562.001Disable or Modify ToolsEvidence1

For example, the DC.exe binary is the Defender Control tool for enabling and disabling Windows Defender. It is triggered by the sample once unpacked.

T1562.004Disable or Modify System FirewallEvidence1

Below are the TTPs identified from our malware analysis. Tactic Technique ID ... Defense evasion Disable or Modify System Firewall T1562.004

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 months ago

hash.md5●●●●●●●●●●●●View more in app4 months ago

hash.sha1●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

gurucul threat researchNews

Jul 14, 2026

ClickFix: Exploiting Compromised WordPress Sites with a Polygon-Based C2 Infrastructure | Community Portal | Gurucul

Mimic5

xakepNews

May 28, 2026

Группировка Fluffy Wolf атаковала российские компании новой малварью - Хакер

Семейство вымогательского ПО, на котором основан Pay2Key.

derp ca blogNews

Mar 26, 2026

Pay2Key encryptor: what a January 2026 build reveals | Derp

Ransomware family and codebase derivative of Conti. The analyzed Pay2Key encryptor is built on Mimic and inherits features such as Everything-based file enumeration and other codebase elements.

cyber security newsNews

Mar 24, 2026

Threat Actors Continuously Attacking MS-SQL Servers to Deploy ICE Cloud Scanner - Cyber Security News

Ransomware used in 2024 attacks on poorly secured MS-SQL servers; the Turkish strings in ICE Cloud are described as directly tying the 2026 campaign to the Mimic ransomware attacks from 2024.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Mimic