Iron

Iron ransomware is a Windows ransomware family observed in 2018 and named after its decryption utility branding, IronUnlocker. It appears to be either a rebranded descendant of, or heavily inspired by, Maktub ransomware, while also borrowing design elements seen in other ransomware families such as DMA Locker and Satan. Attribution remains uncertain, but the malware has been assessed as code-distinct enough that a direct one-to-one identification with Maktub is not definitive.

Iron encrypts a broad set of user and business data types and appends a dedicated extension to encrypted files. It deletes original files after encryption and empties the recycle bin, increasing recovery difficulty. The malware embeds an RSA public key, generates host-specific values, and communicates with command-and-control infrastructure to register the victim and obtain payment-related data, including a victim-specific cryptocurrency payment destination. It also creates a GUID-based mutex to prevent reinfection and stores operational values locally for tracking.

The ransomware excludes numerous system, browser, temporary, and security-related directories from encryption, including folders associated with Qihoo 360 products, indicating deliberate avoidance of destabilizing the host or interfering with certain security software. Unlike some other ransomware families, Iron was not observed deleting Shadow Volume Copies or restore points, leaving open the possibility of partial recovery through native snapshots or forensic recovery tools in some cases.

Analysis of the family identified Chinese Simplified language resources and exclusion logic referencing Chinese security products, suggesting the developer may be a Chinese speaker. Iron has also been discussed as a possible spin-off from the broader Satan ransomware ecosystem, but that relationship is not established with high confidence. The malware is best characterized as a Windows ransomware strain with traits overlapping several contemporaneous crimeware families.