Malware

Mamba

Mamba, also known as HDDCryptor, is a Windows disk-encrypting ransomware family that denies access by encrypting entire drives rather than selectively encrypting user files. It is notable for weaponizing the legitimate open-source full-disk encryption utility DiskCryptor, using it to encrypt system and data partitions and render the operating system unbootable. The malware installs DiskCryptor components, deploys a malicious service to continue execution across reboots, and modifies the boot process by replacing or altering the master boot record so that a ransom screen is shown before normal startup. Reported variants perform the attack in multiple stages, including installing the encryption components, rebooting to complete driver setup, then rebooting again after disk encryption to present the ransom demand.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

According to Renato Marinho, a researcher at Morphus Labs, the malware is believed to be spread through phishing emails and malicious downloads.

T1566PhishingEvidence1

According to Renato Marinho, a researcher at Morphus Labs, the malware is believed to be spread through phishing emails and malicious downloads.

Execution

2 techniques

T1059.003Windows Command ShellEvidence2

The attacker passes the encryption key via the command-line parameter: [Ransomware Filename].exe <password>.

T1569.002Service ExecutionEvidence1

The ransomware extracts a set of files and installs an encryption service... Services: myCryptoraphyService Runs [Ransomware Filename].exe as a service and is removed once encryption is completed.

Persistence

3 techniques

T1542.001System FirmwareEvidence1

Once it infects a machine, it overwrites the host computer's Master Boot Record (MBR) with its own variant, and from there, it will now be able to encrypt the hard drive.

T1542.003BootkitEvidence1

Using the DiskCryptor software, the malware sets up a new bootloader to MBR.

T1543.003Windows ServiceEvidence1

When DiskCryptor is installed, the malware creates a service that has SERVICE_ALL_ACCESS and SERVICE_AUTO_START parameters.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

When DiskCryptor is installed, the malware creates a service that has SERVICE_ALL_ACCESS and SERVICE_AUTO_START parameters.

Stealth

2 techniques

T1542.001System FirmwareEvidence1

Once it infects a machine, it overwrites the host computer's Master Boot Record (MBR) with its own variant, and from there, it will now be able to encrypt the hard drive.

T1542.003BootkitEvidence1

Using the DiskCryptor software, the malware sets up a new bootloader to MBR.

Credential Access

1 technique

T1555Credentials from Password StoresEvidence1

It utilizes Netpass, a free network password recovery tool, as well as DiskCryptor, an open source disk encryption utility.

Discovery

1 technique

T1135Network Share DiscoveryEvidence1

It will then use two programs called "dccon.exe." and "mount.exe," which are responsible for encrypting the files on the computer, and all mapped network drives.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

this group gains access to an organization’s network and uses the psexec utility to execute the ransomware.

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence3

This ransomware uses a legitimate utility called DiskCryptor for full disk encryption.

T1529System Shutdown/RebootEvidence3

The last step of Stage 1 is to reboot the system... When the encryption ends, the system will be rebooted

T1561Disk WipeEvidence2

This kind of ransomware will usually infect the master boot record, thus rendering the operating system unbootable. In addition they encrypt the data on disk or the master file table.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

email●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

neowinNews

May 23, 2026

Mamba ransomware encrypts your hard drive, manipulates the boot process - Neowin

Ransomware that overwrites the Master Boot Record (MBR), manipulates the boot process, and encrypts entire disk partitions rather than only individual files. It also encrypts files on the computer and mapped network drives, preventing the PC from booting unless a decryption key is provided.

detections digest rulecheckNews

Feb 2, 2026

Detections Digest #20260202 - by RuleCheck.io

2FA-focused phishing kit; content discusses URL-parameter-based detection improvements (base64-encoded parameters).

g data software blogNews

Feb 25, 2021

Ransomware identification for the judicious analyst TechBlog

A ransomware family mentioned as a disk encrypter.

bleeping computerNews

May 2, 2020

Sodinokibi, Ryuk ransomware drive up average ransom to $111,000

Ransomware that leverages the open-source DiskCryptor and writes a custom bootloader to the MBR; noted as gaining traction with new variants (including one found in H2 2019).

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Mamba