Technique:  Data Encrypted for Impact
It has used Hermes ransomware to encrypt files with AES256.
It used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.
Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.
AvosLocker has encrypted files and network resources using AES-256 and added an .avos, .avos2, or .AvosLinux extension to filenames.
Babuk can use ChaCha8 and ECDH to encrypt data.
Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.
BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.
Black Basta can encrypt files with the ChaCha20 cypher and using a multithreaded process to increase speed.
BlackCat has the ability to encrypt Windows devices, Linux devices, and VMWare instances.
During C0015, the threat actors used Conti ransomware to encrypt a compromised network.
During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.
Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.
Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use "Windows Restart Manager" to ensure files are unlocked and open for encryption.
Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.
DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.
DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.
Diavol has encrypted files using an RSA key though the CryptEncrypt API and has appended filenames with ".lock64".
Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.
EKANS uses standard encryption library functions to encrypt files.
It has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.
It has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.
FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.
HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.
It has encrypted domain-controlled systems using BitPaymer.
JCry has encrypted files and demanded Bitcoin to decrypt those files.
KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.
LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.
It has used BitLocker and DiskCryptor to encrypt targeted workstations.
Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.
MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.
Netwalker can encrypt files on infected machines to extort victims.
NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.
Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.
Prestige has leveraged the CryptoPP C++ library to encrypt files on target systems using AES and appended filenames with .enc.
ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.
Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.
Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.
REvil can encrypt files on victim systems and demands a ransom to decrypt the files.
RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.
Royal uses a multi-threaded encryption process that can partially encrypt targeted files with the OpenSSL library and the AES256 algorithm.
Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.
SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.
It has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.
Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.
Shamoon has an operational mode for encrypting data instead of overwriting it.
SynAck encrypts the victims machine followed by asking the victim to pay a ransom.
It has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.
ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.
WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.
WastedLocker can encrypt data and leave a ransom note.
Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.
XCSSET performs AES-CBC encryption on files under ~/Documents, ~/Downloads, and~/Desktop with a fixed key and renames files to give them a .enc extension. Only files with sizes less than 500MB are encrypted.