Loading malware…
Shinra is a ransomware strain in the Proton ransomware family, first detected in the wild around April 2024. It has been linked with other Proton-family variants including Limba and Zola. Proton has been assessed as probably Iranian in origin, but this lineage assessment does not establish attribution for individual Shinra activity. Shinra/Proton V2 artifacts have been observed appending a .blue-style extension while renaming encrypted files to random 10-character strings, a behavior that distinguishes them from the separate Blue Locker/MemeCryptor artifact set.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct technique documented for this family, organized by ATT&CK tactic.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Proton-family ransomware variant first submitted to public scanners in April 2024. The article states that Shinra V2 appends .blue, renames encrypted files to random 10-character strings, and uses #Restore-files.txt or #HowToRecover.txt notes.
A Proton-family ransomware strain. The Shinra V2 artifact is distinct from Blue Locker despite sharing the .blue extension.
A ransomware strain assessed as a Proton ransomware-family variant. It was cited by Pakistan's NCERT as similar to Blue Locker and contains strings that could suggest an Asia-related origin, though the report cautions these could be a false flag.
Ransomware referenced as the apparent basis for Blue Locker; another case involving ransomware identifying itself as Shinra was found to be part of the Proton ransomware family.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.