Malware

Spook

Spook is a Windows ransomware family first observed in late 2021 and widely assessed as a Thanos-derived variant with notable code and operational overlap with Prometheus. It is associated with double-extortion activity, combining file encryption with threats to leak stolen data and, in some reporting, threats of data destruction. Public victim-posting infrastructure and negotiation portals were part of its operating model, and manufacturing organizations appeared prominently among observed victims, although multiple industries were affected.

Spook was developed using the leaked Thanos builder, which complicates attribution because code similarities may reflect shared tooling rather than a single operator. Technical analysis has nevertheless identified substantial overlap with Prometheus in ransom-note generation, key identifier logic, and payment-portal design. The malware is implemented in .NET and can encrypt systems without requiring active internet connectivity. It uses symmetric encryption for victim data and protects the generated encryption key material with an attacker-controlled public key, making recovery without the corresponding private key impractical.

Operationally, Spook enumerates local files, folders, and accessible network resources prior to encryption. It attempts to maximize encryption success by terminating processes and stopping services that could lock files or interfere with execution, including database, office, mail, backup, and security-related components. It has also been observed specifically targeting the Raccine anti-ransomware tool for disablement and removal. Persistence and victim notification are reinforced through multiple mechanisms, including ransom-note display on the desktop, startup-based relaunch of the note, and modification of Windows logon notice settings so ransom messaging appears at login.

Spook is part of the broader ecosystem of post-leak Thanos-derived ransomware variants that adopted builder-based customization, aggressive defense evasion, and leak-site-backed extortion. Its behavior aligns with enterprise-impacting ransomware operations focused on rapid encryption, disruption of recovery and protective tooling, and coercive monetization through negotiation portals and public exposure of victim data.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

MITRE ATT&CK Technique ID Technique T1059 Command and Scripting Interpreter

T1569.002Service ExecutionEvidence1

MITRE ATT&CK Technique ID Technique T1569.002 Service Execution

Persistence

3 techniques

T1112Modify RegistryEvidence1

WinLogon is modified (via registry) to display the Ransom Note text upon login ... HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon Str Value: LegalNoticeCaption/Text

T1547.001Registry Run Keys / Startup FolderEvidence2

Ransom notes are also displayed upon login via a Shortcut placed in the Startup directory

T1547.004Winlogon Helper DLLEvidence1

MITRE ATT&CK ... T1547.004 – Boot or Logon Autostart Execution: Winlogon Helper DLL

Privilege Escalation

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence2

Ransom notes are also displayed upon login via a Shortcut placed in the Startup directory

T1547.004Winlogon Helper DLLEvidence1

MITRE ATT&CK ... T1547.004 – Boot or Logon Autostart Execution: Winlogon Helper DLL

Stealth

2 techniques

T1027.002Software PackingEvidence1

MITRE ATT&CK ... T1027.002 – Obfuscated Files or Information: Software Packing

T1218.005MshtaEvidence1

Записки с требованием выкупа называются: RESTORE_FILES_INFO.txt RESTORE_FILES_INFO.hta

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

WinLogon is modified (via registry) to display the Ransom Note text upon login ... HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon Str Value: LegalNoticeCaption/Text

Discovery

3 techniques

T1007System Service DiscoveryEvidence1

MITRE ATT&CK ... T1007 – System Service Discovery ... In addition, sc.exe is used to disable specific services and components

T1018Remote System DiscoveryEvidence1

the malware proceeds to enumerate local files and folders, along with accessible network resources

T1082System Information DiscoveryEvidence1

MITRE ATT&CK ... T1082 – System Information Discovery

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence4

MITRE ATT&CK ... T1486 – Data Encrypted for Impact ... Spook, mirroring the manifestos of others, boasts “very strong (AES) encryption” ... Encryption of a full disk can occur within just a few minutes

T1490Inhibit System RecoveryEvidence1

MITRE ATT&CK Technique ID Technique T1490 Inhibit System Recovery

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

MITRE ATT&CK Technique ID Technique T1562.001 Disable or Modify Tools

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

sekoia blogNews

Jul 28, 2026

EternityTeam: A New Prominent Threat Group

Mentioned only in passing as an example of a ransomware group/tool relationship from prior investigations.

sentinelone labsNews

May 7, 2026

Spook Ransomware | Prometheus Derivative Names Those That Pay, Shames Those That Don’t | SentinelOne

Ransomware that encrypts files and disks using AES, can operate offline, displays ransom notes via HTA/startup/Winlogon persistence, terminates processes and disables services that may hinder encryption, and extorts victims through a TOR-based payment portal while threatening public data leakage.

zscaler threat labzNews

Jan 1, 2026

A Study of Thanos Ransomware Variants | Zscaler Blog

A Thanos-derived ransomware variant that encrypts files, appends a .{ID} extension, drops RESTORE_FILES_INFO ransom notes, and uses double extortion via its own leak site.

id ransomware blogNews

Oct 1, 2016

Шифровальщики-вымогатели The Digest "Crypto-Ransomware": Hakbit, Thanos

A ransomware family mentioned as part of the broader lineage descending from the same builder ecosystem as Hakbit/Thanos.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Spook