Loading malware…
Spook is a Windows ransomware family first observed in late 2021 and widely assessed as a Thanos-derived variant with notable code and operational overlap with Prometheus. It is associated with double-extortion activity, combining file encryption with threats to leak stolen data and, in some reporting, threats of data destruction. Public victim-posting infrastructure and negotiation portals were part of its operating model, and manufacturing organizations appeared prominently among observed victims, although multiple industries were affected.
Spook was developed using the leaked Thanos builder, which complicates attribution because code similarities may reflect shared tooling rather than a single operator. Technical analysis has nevertheless identified substantial overlap with Prometheus in ransom-note generation, key identifier logic, and payment-portal design. The malware is implemented in .NET and can encrypt systems without requiring active internet connectivity. It uses symmetric encryption for victim data and protects the generated encryption key material with an attacker-controlled public key, making recovery without the corresponding private key impractical.
Operationally, Spook enumerates local files, folders, and accessible network resources prior to encryption. It attempts to maximize encryption success by terminating processes and stopping services that could lock files or interfere with execution, including database, office, mail, backup, and security-related components. It has also been observed specifically targeting the Raccine anti-ransomware tool for disablement and removal. Persistence and victim notification are reinforced through multiple mechanisms, including ransom-note display on the desktop, startup-based relaunch of the note, and modification of Windows logon notice settings so ransom messaging appears at login.
Spook is part of the broader ecosystem of post-leak Thanos-derived ransomware variants that adopted builder-based customization, aggressive defense evasion, and leak-site-backed extortion. Its behavior aligns with enterprise-impacting ransomware operations focused on rapid encryption, disruption of recovery and protective tooling, and coercive monetization through negotiation portals and public exposure of victim data.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Technique ID Technique T1059 Command and Scripting Interpreter
MITRE ATT&CK Technique ID Technique T1569.002 Service Execution
WinLogon is modified (via registry) to display the Ransom Note text upon login ... HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon Str Value: LegalNoticeCaption/Text
Ransom notes are also displayed upon login via a Shortcut placed in the Startup directory
MITRE ATT&CK ... T1547.004 – Boot or Logon Autostart Execution: Winlogon Helper DLL
Ransom notes are also displayed upon login via a Shortcut placed in the Startup directory
MITRE ATT&CK ... T1547.004 – Boot or Logon Autostart Execution: Winlogon Helper DLL
MITRE ATT&CK ... T1027.002 – Obfuscated Files or Information: Software Packing
Записки с требованием выкупа называются: RESTORE_FILES_INFO.txt RESTORE_FILES_INFO.hta
WinLogon is modified (via registry) to display the Ransom Note text upon login ... HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon Str Value: LegalNoticeCaption/Text
MITRE ATT&CK Technique ID Technique T1562.001 Disable or Modify Tools
MITRE ATT&CK ... T1007 – System Service Discovery ... In addition, sc.exe is used to disable specific services and components
the malware proceeds to enumerate local files and folders, along with accessible network resources
MITRE ATT&CK ... T1082 – System Information Discovery
MITRE ATT&CK ... T1486 – Data Encrypted for Impact ... Spook, mirroring the manifestos of others, boasts “very strong (AES) encryption” ... Encryption of a full disk can occur within just a few minutes
MITRE ATT&CK Technique ID Technique T1490 Inhibit System Recovery
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.