Malware

Midas

Midas is a Windows ransomware family that emerged in 2021 and is widely assessed as a Thanos-derived variant built from the leaked Thanos ransomware builder. It is written in C# on the .NET framework and has been observed using SmartAssembly obfuscation. Midas is associated with double-extortion operations in which attackers steal data and threaten public release in addition to encrypting victim systems. It appends an extension based on the targeted organization’s name and typically drops HTA and text ransom notes.

Technically, Midas encrypts files with Salsa20 and protects the symmetric key with RSA public-key encryption. It has been observed terminating processes and services associated with security tools, databases, backup software, and office applications to maximize encryption coverage and reduce interference. It also deletes shadow copies to inhibit recovery and can establish persistence by creating a startup shortcut to reopen the ransom note after reboot.

Intrusions culminating in Midas deployment have relied heavily on hands-on-keyboard tradecraft and legitimate administrative tooling rather than a single distinctive malware delivery chain. Documented attacks involved prolonged dwell time, extensive use of PowerShell, internal RDP, malicious service creation, DLL sideloading through DISM, reflective loading, credential theft with Mimikatz, use of commercial remote access tools, and attempts to disable endpoint protections with Process Hacker before ransomware execution. In at least one investigated case, attackers leveraged administrator-level access to a domain controller, moved laterally across a flat Windows server environment, exfiltrated data, and then deployed ransomware gradually across servers. Midas has been linked to campaigns against enterprise environments, including a technology-sector victim, and operational overlaps have been noted with other Thanos-derived brands such as Haron, Prometheus, and Spook.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

25 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

It remains unknown how the attackers initially accessed the domain controller, or how they had compromised and taken control over the Administrator account on that machine. But once they had, the attackers leveraged the permissions from that account.

T1133External Remote ServicesEvidence1

made extensive use of vulnerable remote access services

Execution

5 techniques

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK Technique ID Technique T1059 Command and Scripting Interpreter

T1059.001PowerShellEvidence2

a new, bare-bones ransomware that offloads most of its functionality to a series of PowerShell scripts

T1059.003Windows Command ShellEvidence1

For instance, a PowerShell script would execute a Batch file, that in turn would launch a PowerShell script.

T1059.005Visual BasicEvidence1

They also orchestrated parts of the attack using Visual Basic Script and Batch files, executed using the DISM.exe utility.

T1569.002Service ExecutionEvidence1

MITRE ATT&CK Technique ID Technique T1569.002 Service Execution

Persistence

4 techniques

T1078Valid AccountsEvidence1

T1112Modify RegistryEvidence1

MITRE ATT&CK Technique ID Technique T1112 Modify Registry

T1133External Remote ServicesEvidence1

made extensive use of vulnerable remote access services

T1543.003Windows ServiceEvidence1

The attack involved repeated iterations of the threat actors creating Windows services designed to execute, on one machine at a time, several PowerShell scripts the attackers had placed on a few of the other compromised servers.

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

T1543.003Windows ServiceEvidence1

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

An example of the heavily obfuscated PowerShell scripts the attackers ran on several machines over the course of many weeks. The scripts use layers of obfuscation that self-expand when executed.

T1078Valid AccountsEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

MITRE ATT&CK Technique ID Technique T1112 Modify Registry

Discovery

4 techniques

T1010Application Window DiscoveryEvidence1

MITRE ATT&CK Technique ID Technique T1010 Application Window Discovery

T1057Process DiscoveryEvidence1

MITRE ATT&CK Technique ID Technique T1057 Process Discovery

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK Technique ID Technique T1083 File and Directory Discovery

T1518.001Security Software DiscoveryEvidence1

MITRE ATT&CK Technique ID Technique T1518.001 Security Software Discovery

Lateral Movement

4 techniques

T1021Remote ServicesEvidence1

They executed commands, launched internal RDP connections, took advantage of already-installed commercial remote access software, exfiltrated data to the cloud, and moved files to and from one of the target’s domain controllers over a two month period.

T1021.001Remote Desktop ProtocolEvidence1

The earliest indicator of compromise took place on October 13, when logs on one of the compromised domain controllers indicate that a Remote Desktop Protocol (RDP) connection took place between a machine on the internal network of the targeted organization and the domain controller.

T1021.002SMB/Windows Admin SharesEvidence1

The attackers had placed on a few of the other compromised servers, which any other machine — VM or server — could just browse to over SMB.

T1570Lateral Tool TransferEvidence2

A few minutes later, the attackers moved copies of two ransomware binaries, named <target>local.exe and <target>share.exe ... to an internal server and executed it.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

During the first week the attackers were connected to the network, they were uploading various PowerShell scripts into the TEMP directory of some of the machines they controlled.

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

They executed commands, launched internal RDP connections, took advantage of already-installed commercial remote access software, exfiltrated data to the cloud.

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence3

late at night of December 7 in the target’s time zone, the attackers began deploying the ransomware binary to machines on the target’s network.

T1489Service StopEvidence2

We also recovered PowerShell scripting commands that the attackers used in an attempt to shut down 46 processes, and 216 services, by name.

T1490Inhibit System RecoveryEvidence1

MITRE ATT&CK Technique ID Technique T1490 Inhibit System Recovery

Other

2 techniques

T1562Impair DefensesEvidence1

In some cases, the attackers deployed and used the open-source tool Process Hacker to identify and terminate the endpoint security products that the target was using to protect its systems.

T1562.001Disable or Modify ToolsEvidence1

MITRE ATT&CK Technique ID Technique T1562.001 Disable or Modify Tools

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app9 months ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

sophos threat researchNews

Jan 1, 2026

Windows services lay the groundwork for a Midas ransomware attack | SOPHOS

Ransomware used in a December 2021 intrusion against a technology vendor. The attackers spent weeks moving laterally, using PowerShell, RDP, AnyDesk, TeamViewer, Process Hacker, and backdoored components before deploying Midas binaries across servers.

sophos threat researchNews

Jan 1, 2026

The Ransomware Threat Intelligence Center | SOPHOS

Ransomware attack leveraging vulnerable remote access services and PowerShell scripts.

zscaler threat labzNews

Jan 1, 2026

A Study of Thanos Ransomware Variants | Zscaler Blog

A Thanos-derived ransomware variant written in C# that uses double extortion via its own leak site, terminates security/database/backup processes and services, deletes shadow copies, and encrypts files with Salsa20 while protecting keys with RSA.

sophos threat researchNews

Jan 1, 2026

Windows services lay the groundwork for a Midas ransomware attack | SOPHOS

Ransomware used in a December 2021 attack against a technology vendor. The attackers spent weeks on the network, used PowerShell, RDP, AnyDesk, TeamViewer, Process Hacker, and credential theft before deploying Midas binaries across servers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping25

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Midas