ATT&CK Ransomware Software Hub: Detecting Encryptors and Their Enablers by Behaviour

Ransomware families change names faster than detection rules can be rewritten, but the behaviour ATT&CK records for them barely changes at all. This hub gathers the 76 ATT&CK Enterprise v20 software entries NHI Mgmt Group files under ransomware: 59 encryptors that ATT&CK maps to T1486 Data Encrypted for Impact, one destructive family disguised as ransomware, and 16 enablers (loaders, stealers, C2 and exfiltration tools) that sit on the path to encryption. It shows which techniques recur across the catalogue, how to detect them regardless of the family name, and where identities decide the scale of an attack. It is for detection engineers, threat intelligence analysts and SOC leads who want one reference view of the catalogue. For the full programme, see the Ransomware Prevention Guide; this page stays on the ATT&CK software view.

Key takeaways

• Behaviour outlives brand names. Across the 76 entries, T1486 appears 59 times, T1083 File and Directory Discovery 46 times and T1490 Inhibit System Recovery 40 times: detections built on these survive every rebrand.
• The impact chain is predictable. Service stop (T1489, 36 entries), tool tampering (T1685, 31) and share discovery (T1135, 30) come before encryption, giving defenders minutes to act.
• A fifth of the hub never encrypts anything. QakBot, Bazar, Bumblebee, Pikabot, SystemBC, Vidar and StealBit are in this catalogue because they deliver, steer or monetise ransomware; catching them is cheaper than catching the encryptor.
• Windows dominates, but hypervisors set the blast radius. 72 entries list Windows, 10 Linux and 6 ESXi; a single ESXi encryptor can take down every virtual machine on a host.
• Identity decides scale. Domain admin, Group Policy, hypervisor root and cloud access keys turn one infected host into an estate-wide outage, as the Storm-0501 and Codefinger cases show.

What this hub covers and how it was built

MITRE ATT&CK catalogues software as malware or tools and links each entry to the techniques it uses and the groups and campaigns that used it. ATT&CK does not group software by category, so NHI Mgmt Group assigned every v20 Enterprise software entry to one hub. This hub holds 76 entries, all typed as malware. Membership follows the primary role: a loader that is mostly used to deliver ransomware sits here, while general purpose loaders and remote access trojans have their own hubs (see the ATT&CK Loaders and Droppers Software Hub and the ATT&CK Remote Access Trojans Software Hub). NotPetya and KillDisk are kept here because ATT&CK maps both to T1486, even though it describes NotPetya's main purpose as destroying data, and WhisperGate is here because ATT&CK describes it as a wiper designed to look like ransomware.

All counts on this page were computed from the ATT&CK Enterprise v20 STIX data: active (non-revoked, non-deprecated) "uses" relationships from each software entry to techniques, and from groups and campaigns to the software. Counts change as MITRE adds procedure examples, so treat them as a snapshot of v20.

Common behaviours across the catalogue

The table below lists the techniques most often mapped across the 76 entries. It is the most useful single view for prioritising analytics: a rule that fires on T1490 behaviour covers 40 catalogue entries at once.

Two patterns stand out. First, discovery is heavy and noisy: T1083, T1057, T1082 System Information Discovery and T1135 all appear in at least 30 entries, because encryptors must find what to encrypt and what to stop. Second, defence impairment is routine. ATT&CK v20 moved tool tampering to T1685 Disable or Modify Tools under the Defense Impairment tactic (TA0112), and 31 entries map to it, with T1685.005 Clear Windows Event Logs in 10. See the ATT&CK Stealth and Defense Impairment Tactics Guide.

Detection themes that work across families

Write analytics for the behaviour, then use the family name only for enrichment. The joint #StopRansomware Guide from CISA, MS-ISAC, NSA and FBI tells responders to hunt specifically for misuse of vssadmin.exe, wbadmin.exe, bcdedit.exe, fsutil (deletejournal) and wmic (shadowcopy), which are the T1490 behaviours seen across this hub.

• Recovery inhibition (T1490): alert on shadow copy deletion or resize, backup catalogue deletion, boot configuration changes that disable recovery, and USN journal deletion. These have few legitimate uses on servers and are the best early signal in the catalogue. See the T1490 Inhibit System Recovery Defensive Guide.
• Mass service stop (T1489): many service stops in a short window, especially database, backup, Exchange and security services, from one parent process or remote session. See the MITRE ATT&CK T1489 Service Stop.
• Security tool tampering (T1685): EDR sensor stops, tamper protection events, exclusion changes and event log clearing (Windows Security event 1102, System event 104) on hosts that were healthy minutes earlier.
• File write rate and entropy (T1486): one process modifying and renaming large numbers of files, new uniform extensions, and the same note file written to many directories. Canary files on file servers make this cheap to detect. See the MITRE ATT&CK T1486 Data Encrypted for Impact.
• Share sweeps (T1135, T1021.002): one workstation or server connecting to many SMB shares it does not normally touch, often followed by writes. See the T1135 Network Share Discovery Defensive Guide.
• Mass deployment paths: new Group Policy scheduled tasks (T1484.001), PsExec style service creation (T1569.002) and WMI process creation across many hosts at once. Microsoft reported Storm-0501 pushing Embargo through a Group Policy scheduled task. See the MITRE ATT&CK T1484 Domain or Tenant Policy Modification Guide.
• Enabler activity: loader and C2 traffic from the enablers in the table below often appears days before encryption. Treat a QakBot, Bumblebee, Pikabot or SystemBC detection as a pre-ransomware incident, not a commodity malware clean-up.

Prevention and hardening themes

ATT&CK maps only two mitigations directly to T1486: M1040 Behavior Prevention on Endpoint and M1053 Data Backup. T1490 adds M1038 Execution Prevention, M1028 Operating System Configuration and M1018 User Account Management. Everything else works by breaking the earlier stages.

1. Protect recovery first. Keep offline, encrypted backups and golden images, and test restores; CISA notes that many variants search for and delete reachable backups. The NCSC adds that backup accounts need privileged access workstations, MFA on a separate device and IP allow listing.
2. Turn on behaviour blocking. Enable EDR tamper protection and ransomware behaviour rules, and on Windows consider Controlled Folder Access for user data.
3. Restrict the recovery-killing binaries. Limit who can run vssadmin, wbadmin, bcdedit and wmic shadowcopy operations, and alert on the rest.
4. Close the common entry points. Do not expose RDP to the internet, patch internet-facing systems quickly, block SMB (445, 137 to 139) at the perimeter and disable SMBv1, as the #StopRansomware Guide recommends.
5. Segment and tier. Separate user, server, hypervisor and backup networks; keep hypervisor management off the user domain. See the ESXi Ransomware Playbook.
6. Prepare cloud storage. Enable versioning, object lock and delete protection on buckets that hold critical data, and alert on lifecycle rule changes. See the Cloud Ransomware Guide.

Where identity fits

Encryptors run with whatever privileges the operator already holds, so the identities around them set the blast radius.

• Directory and sync accounts: Microsoft reported that Storm-0501 extracted Entra Connect Sync credentials and took over a cloud Global Administrator whose on-premises counterpart was a Domain Admin without MFA, before deploying Embargo in some intrusions. See the Storm-0501 Hybrid Cloud Attacks 2024 page.
• Cloud access keys: in the Codefinger campaign, Halcyon reported stolen long-term AWS keys with s3:GetObject and s3:PutObject rights being used to re-encrypt objects with SSE-C keys only the attacker held. No malware from this catalogue was needed. See the Codefinger S3 Ransomware 2025 page.
• Deployment and management identities: Group Policy, software deployment, RMM and hypervisor management accounts can push an encryptor to every host. Treat them as Tier 0 and require just-in-time elevation.
• Service accounts: backup, database and monitoring service accounts often hold broad share access and are targeted by the credential stealers in the enabler group. See the Recovering IAM and PAM After Ransomware or Domain Compromise.

Common failure patterns

• Family-name detections: rules keyed to one ransom note name or extension miss the next rebrand; the catalogue shows behaviour is far more stable than names. See the Ransomware Family Lineage and Rebrands Guide.
• Treating loaders as commodity malware: closing a QakBot or Bumblebee ticket after re-imaging one laptop, without hunting for the credentials and footholds it handed on.
• Backups on the same identity plane: backup consoles joined to the production domain, so the same Domain Admin that deploys the encryptor deletes the backups.
• Blind hypervisors: no logging from ESXi hosts or vCenter, so encryption of datastores is seen only when virtual machines stop.
• Ignoring cloud write keys: long-lived storage keys with write rights and no versioning, which turn a leaked key into an extortion tool, as in the Codefinger case.

Framework mapping

For the NIST ransomware profile itself, see the NIST IR 8374 Rev 1 Ransomware Risk Management Profile Guide.

Catalogue: all 76 ransomware hub entries

Every entry is ATT&CK software type malware. Group and campaign links come from v20 "uses" relationships; where a live NHI Mgmt Group actor profile exists, the group name links to it. "Signature techniques" are up to four impact or enabling techniques the entry maps to, chosen in priority order (T1486, T1490, T1489, T1485, T1685 and so on), and "Techniques mapped" is the total count in v20. Role is Encryptor where the entry maps to T1486. Entries are listed alphabetically.

Deep pages for families in this catalogue include the BlackByte Ransomware Profile Guide, Conti Ransomware Profile Guide, REvil (Sodinokibi), Royal and BlackSuit Ransomware Profile Guide, LockBit Threat Actor Profile, Qilin Threat Actor Profile and RansomHub Threat Actor Profile. For the group view, see the Ransomware Groups Guide. Wipers that do not pose as ransomware are in the ATT&CK Wipers and Destructive Malware Software Hub, and stealers in the ATT&CK Infostealers Software Hub.

Practitioner checklist

• Build or confirm analytics for T1490, T1489, T1685 and T1486 that do not depend on a family name.
• Alert on vssadmin, wbadmin, bcdedit, fsutil deletejournal and wmic shadowcopy use on servers.
• Treat any loader or C2 detection from the enabler group as a possible pre-ransomware intrusion and hunt for credential theft.
• Keep offline or immutable backups on a separate identity plane, and test restores on a schedule.
• Collect logs from ESXi, vCenter and backup consoles, and alert on mass virtual machine shutdowns.
• Tier deployment, Group Policy, hypervisor and sync accounts as Tier 0 with phishing-resistant MFA and just-in-time access.
• Enable versioning and object lock on critical cloud storage and retire long-lived write keys.
• Map your detection coverage against the common behaviours table and close the largest gaps first.

Standards and references

• MITRE ATT&CK: Software
• MITRE ATT&CK: T1486 Data Encrypted for Impact
• MITRE ATT&CK: T1490 Inhibit System Recovery
• CISA, MS-ISAC, NSA and FBI: #StopRansomware Guide
• NCSC: Mitigating malware and ransomware attacks
• NIST: Cybersecurity Framework 2.0
• CIS: Critical Security Controls v8.1

Related NHI Mgmt Group resources: Ransomware Response and Recovery Guide, Cloud Ransomware Response Playbook, ATT&CK Impact Tactic Guide, Ransomware-as-a-Service Business Model Guide.