Loading malware…
RobbinHood is a human-operated Windows ransomware family that targets companies, enterprise networks, and government environments. Reporting in the provided content links it to the 2019 Baltimore city government incident and describes operators typically gaining access through exposed RDP or other prior compromise, then deploying the ransomware manually to individual machines via PsExec and/or after domain controller compromise rather than through self-propagation or network-share spreading. The malware requires a public RSA key to already exist at C:\Windows\Temp\pub.key before encryption begins, indicating a staged intrusion with prior administrative access.
Behaviorally, RobbinHood disconnects network shares using "cmd.exe /c net use * /DELETE /Y", searches for Windows services associated with antivirus and other software, and stops large numbers of services via sc.exe stop, including AV, database, mail, and backup-related services. It deletes shadow copies using "vssadmin.exe delete shadows /all /quiet" and "WMIC shadowcopy delete", clears Windows event logs with wevtutil, and disables Windows recovery/automatic repair with bcdedit commands. The content also states it uses cmd.exe on victim systems.
For encryption, RobbinHood creates a unique AES key per file, encrypts the AES key and original filename with RSA, and renames files in the format Encrypted_[randomstring].enc_robbinhood. It drops ransom notes named _Decrypt_Files.html, _Decryption_ReadMe.html, _Help_Help_Help.html, and _Help_Important.html. The ransom demand described is 3 BTC per affected system or 13 BTC for the full network, with price increases after several days.
The content further notes RobbinHood operators have used BYOVD techniques to disable defenses. Specifically, one campaign abused a legitimate vulnerable GIGABYTE motherboard driver, GDRV.SYS (CVE-2018-19320), to disable Driver Signature Enforcement and install a malicious driver; Sophos also reported a February 2020 RobbinHood campaign abusing a legitimate motherboard manufacturer driver to disable EDR products. The malware family is therefore associated with defense evasion through both service termination and vulnerable-driver abuse.
High-confidence indicators and artifacts mentioned in the content include the sample SHA-256 3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b; temporary log files under C:\Windows\Temp named rf_, ro_l, and ro_s; the required RSA key path C:\Windows\Temp\pub.key; and embedded Go source path strings including C:/Users/valery/go/src/oldboy/config.go, functions.go, and main.go.
The content also states that an Iranian national, Sina Gholinejad (aka Sina Ghaaf), pleaded guilty in the U.S. for involvement in an international ransomware and extortion scheme involving Robbinhood ransomware against multiple U.S. organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
2019: ...computer systems are seized by hackers using ransomware known as RobbinHood.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
this could indicate that the payload is being pushed to each individual machine via a domain controller or through a framework like Empire PowerShell and PSExec.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
This ransomware is not being distributed through spam but rather through other methods, which could include hacked remote desktop services or other Trojans that provide access to the attackers.
Now that the computer is prepped, it begins to encrypt the victim's targeted files. Kremez told BleepingComputer that when encrypting files an AES key is created for each file. The ransomware will then encrypt the AES key and the original filename with the public RSA encryption key and append it to the encrypted file.
Next it will stop 181 Windows services associated with antivirus, database, mail server, and other software that could keep files open and prevent their encryption.
Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.
At this level of access, attackers can accomplish a lot: hide malware, dump credentials, and, crucially, attempt to disable EDR solutions.
Examples include 'Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools', 'BlackByte disabled security tools such as Windows Defender', 'Scattered Spider has uninstalled and disabled security tools', and many malware families terminating AV/EDR processes or services.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware used in intrusions against U.S. organizations (including Baltimore incident referenced) to encrypt files for extortion.
Ransomware used in a BYOVD campaign to disable EDR products via abuse of a legitimate signed vulnerable driver.
RobbinHood is a ransomware strain used in attacks that encrypt files and demand ransom payments, with known criminal prosecutions linked to its use.
Ransomware that deletes shadow copies to prevent data restoration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.