MalwareUsed by 1 actor

SFile

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Mindware

Sfile Ransomware Variants: Sfile2, Sfile3, Escal Sfile NextGen Ransomware ... Генеалогия: Sfile > Sfile2, Sfile3 > Escal > Sfile NextGen

via id ransomware blogid-ransomware.blogspot.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

5 techniques

T1133External Remote ServicesEvidence1

Может распространяться путём взлома через незащищенную конфигурацию RDP...

T1189Drive-by CompromiseEvidence1

...обманных загрузок... вредоносной рекламы... веб-инжектов, фальшивых обновлений...

T1190Exploit Public-Facing ApplicationEvidence1

...ботнетов, эксплойтов...

T1566PhishingEvidence1

Может распространяться путём взлома через незащищенную конфигурацию RDP, с помощью email-спама и вредоносных вложений...

T1566.001Spearphishing AttachmentEvidence1

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK ... T1059 – Command and Scripting Interpreter

Persistence

2 techniques

T1112Modify RegistryEvidence1

MITRE ATT&CK ... T1112 – Modify Registry

T1133External Remote ServicesEvidence1

Может распространяться путём взлома через незащищенную конфигурацию RDP...

Stealth

2 techniques

T1027.002Software PackingEvidence1

MITRE ATT&CK ... T1027.002 – Obfuscated Files or Information: Software Packing

T1070.004File DeletionEvidence1

Backups, replications were either encrypted or wiped. Shadow copies also removed.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

MITRE ATT&CK ... T1112 – Modify Registry

Credential Access

1 technique

T1110Brute ForceEvidence1

Although we do not yet have specifics as to how Mindware attacks are initiated, SFile is known to use RDP bruteforce as an entry vector into an organization.

Discovery

3 techniques

T1007System Service DiscoveryEvidence1

MITRE ATT&CK ... T1007 – System Service Discovery

T1018Remote System DiscoveryEvidence1

MITRE ATT&CK ... T1018 – Remote System Discovery

T1082System Information DiscoveryEvidence1

MITRE ATT&CK ... T1082 – System Information Discovery

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

...перепакованных и заражённых инсталляторов.

Impact

3 techniques

T1485Data DestructionEvidence1

MITRE ATT&CK TA0005 – Defense Evasion T1485 – Data Destruction T1486 – Data Encrypted for Impact

T1486Data Encrypted for ImpactEvidence2

Этот крипто-вымогатель шифрует данные корпоративной сети и бизнес-пользователей... All files on each host in the network have been encrypted with a strong algorithm.

T1490Inhibit System RecoveryEvidence1

Backups, replications were either encrypted or wiped. Shadow copies also removed.

INDICATORS OF COMPROMISE

IOCs tracked for this family

35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

20 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

id ransomware blogNews

Aug 12, 2026

Шифровальщики-вымогатели The Digest "Crypto-Ransomware": Sfile, Escal

A ransomware family targeting corporate networks and business users. It encrypts files using combinations including SHA-512, AES-256, and RSA-2048, appends variant-specific extensions, drops ransom notes, may delete shadow copies and impact backups/replications, and later variants also threaten data theft and publication.

sentinelone blogNews

Jun 6, 2022

Mindware and SFile Ransomware Technical Breakdown

Earlier ransomware strain first seen in 2020 and active through 2021. It shares code and behavior with Mindware, including reflective DLL injection, similar command-line parameters, drive encryption logic, and process-killing behavior; it is known to use RDP bruteforce as an entry vector.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching35

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

SFile

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Mindware

Sfile Ransomware Variants: Sfile2, Sfile3, Escal Sfile NextGen Ransomware ... Генеалогия: Sfile > Sfile2, Sfile3 > Escal > Sfile NextGen

via id ransomware blogid-ransomware.blogspot.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

5 techniques

T1133External Remote ServicesEvidence1

Может распространяться путём взлома через незащищенную конфигурацию RDP...

T1189Drive-by CompromiseEvidence1

...обманных загрузок... вредоносной рекламы... веб-инжектов, фальшивых обновлений...

T1190Exploit Public-Facing ApplicationEvidence1

...ботнетов, эксплойтов...

T1566PhishingEvidence1

T1566.001Spearphishing AttachmentEvidence1

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK ... T1059 – Command and Scripting Interpreter

Persistence

2 techniques

T1112Modify RegistryEvidence1

MITRE ATT&CK ... T1112 – Modify Registry

T1133External Remote ServicesEvidence1

Может распространяться путём взлома через незащищенную конфигурацию RDP...

Stealth

2 techniques

T1027.002Software PackingEvidence1

MITRE ATT&CK ... T1027.002 – Obfuscated Files or Information: Software Packing

T1070.004File DeletionEvidence1

Backups, replications were either encrypted or wiped. Shadow copies also removed.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

MITRE ATT&CK ... T1112 – Modify Registry

Credential Access

1 technique

T1110Brute ForceEvidence1

Although we do not yet have specifics as to how Mindware attacks are initiated, SFile is known to use RDP bruteforce as an entry vector into an organization.

Discovery

3 techniques

T1007System Service DiscoveryEvidence1

MITRE ATT&CK ... T1007 – System Service Discovery

T1018Remote System DiscoveryEvidence1

MITRE ATT&CK ... T1018 – Remote System Discovery

T1082System Information DiscoveryEvidence1

MITRE ATT&CK ... T1082 – System Information Discovery

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

...перепакованных и заражённых инсталляторов.

Impact

3 techniques

T1485Data DestructionEvidence1

MITRE ATT&CK TA0005 – Defense Evasion T1485 – Data Destruction T1486 – Data Encrypted for Impact

T1486Data Encrypted for ImpactEvidence2

T1490Inhibit System RecoveryEvidence1

Backups, replications were either encrypted or wiped. Shadow copies also removed.

INDICATORS OF COMPROMISE

IOCs tracked for this family

35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

20 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

id ransomware blogNews

Aug 12, 2026

Шифровальщики-вымогатели The Digest "Crypto-Ransomware": Sfile, Escal

sentinelone blogNews

Jun 6, 2022

Mindware and SFile Ransomware Technical Breakdown

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching35

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.