Article
Akira ransomware advisory AA24-109A: stages and tools
CISA and partners say Akira enters through VPNs without MFA and known CVEs, steals data, then encrypts. A read of advisory AA24-109A, updated Nov…
Read more
Attack technique
Data Encrypted for Impact
Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key.
In short
Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. It is the core step of ransomware. MITRE ATT&CK lists it as an Impact technique.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Impact · Step 15 Of 15 In The Attack Chain
- MITRE IDT1486ATT&CK technique
- Detection4ways to spot itBursts of file changes · Detection strategy MITRE lists
- Defences3ways to stop itKeep tested backups off system
How it works
The aim is to cut off availability. Attackers encrypt data on one system or on many systems across a network, then withhold the decryption key. Some want payment in exchange for the key. In other cases the data is made permanently inaccessible because the key is never saved or sent.
With ransomware, common user files such as documents, PDFs, images, videos, audio, text and source code are usually encrypted, and often renamed or tagged. Attackers may first need other steps, such as changing file permissions, to reach these files. Some attacks also encrypt critical system files, disk partitions or virtual machines on hypervisors such as ESXi.
To increase the damage, the malware may spread across a network like a worm, using other techniques such as valid accounts and credential dumping. It may also change wallpapers or login messages, or send ransom notes to connected printers.
In cloud environments, storage objects in a compromised account can be encrypted too.
A real example
MITRE ATT&CK lists these procedure examples:
- WannaCry encrypts user files and demands a ransom in Bitcoin to decrypt them.
- NotPetya encrypts user files and disk structures such as the master boot record using 2048-bit RSA.
- SamSam encrypts victim files with RSA-2048 and demands a Bitcoin ransom.
- Bad Rabbit encrypts files and disks using AES-128-CBC and RSA-2048.
Who uses it
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Cl0p Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. Active · Since 2019 · Ransomware as a service, and data theft campaigns (per the advisory)
- Ransomware group Conti ransomware group Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. Inactive · Since 2019 · Ransomware as a service, with a wage model per CISA
- Ransomware group DarkSide DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S. Inactive · Since 2020 · Ransomware as a service
- Ransomware group Everest Everest is a financially motivated ransomware and data extortion group. Active · Since 2020 · Extortion group with ransomware and initial access broker activity
- Ransomware group Hive Hive was a ransomware as a service operation active from June 2021. Disrupted · Since 2021 · Ransomware as a service
- Ransomware group Interlock Interlock is a ransomware group first observed in late September 2024. Active · Since 2024 · Not stated in the advisory (opportunistic and financially motivated, per the FBI)
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
- Ransomware group Lynx Lynx is a ransomware group that the Cyber Security Agency of Singapore named on 16 August 2025 as one of at least eight groups using a tool that switches off endpoint security software. Active · Not stated in official sources
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
- Ransomware group Qilin Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Active · Since 2022 · Ransomware as a service
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group REvil ransomware group REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019. Disrupted · Since 2019 · Ransomware as a service
- Ransomware group Rhysida Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Active · Since 2023 · Ransomware as a service (profit-sharing with associates)
- Ransomware group Vice Society Vice Society is an intrusion, exfiltration and extortion group that first appeared in summer 2021, per joint advisory AA22-249A (FBI, CISA and MS-ISAC, September 6, 2022). Since 2021 · Not stated in the advisory
- Ransomware group Warlock Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers. Since 2025 · Not stated by the sources
Seen in incidents
- Incident AIIMS Delhi cyber attack, 2022 On 23 November 2022 the servers of the All India Institute of Medical Sciences (AIIMS) in New Delhi went down in a cyber attack that some reports called ransomware. November to December 2022 · Healthcare
- Incident Colonial Pipeline ransomware attack (May 2021) The Colonial Pipeline ransomware attack began on 7 May 2021, when the US petroleum pipeline operator shut down its pipeline system after a DarkSide attack on its IT network. May 2021 · Energy and utilities
- Incident ESXiArgs ransomware campaign against VMware ESXi servers In early February 2023 a ransomware campaign hit VMware ESXi servers that were exposed to the internet and not patched. February 2023 · Multiple sectors
- Incident HSE Conti ransomware attack In May 2021 Conti ransomware hit Ireland's Health Service Executive (HSE), the public health service. May 2021 · Healthcare
- Incident Lazio Region ransomware attack on the regional health system In the night between 31 July and 1 August 2021, a ransomware attack hit the data center that runs the IT systems of the Lazio Region in Italy and its health services. July to August 2021 · Government and public sector
- Incident Newfoundland and Labrador health system ransomware attack (2021) In October 2021 the Hive ransomware group attacked the health information systems of Newfoundland and Labrador, Canada. October to December 2021 · Healthcare
- Incident PDNS 2 national data center ransomware attack, Indonesia, 2024 The PDNS 2 national data center ransomware attack on 20 June 2024 disrupted Indonesia's Temporary National Data Center 2 in Surabaya, which hosts central and local government systems. June 2024 · Government and public sector
- Incident Pemex ransomware attack, Mexico, 2019 Pemex, Mexico's state oil company, detected a ransomware attack on 10 November 2019 that began at a computer center in the State of Mexico. November 2019 · Energy and utilities
- Incident Romanian hospital information system ransomware attack The Romanian hospital information system ransomware attack hit the servers behind the hospital information system (HIS) used by many Romanian hospitals in the night of 11 to 12 February 2024. February 2024 · Healthcare
- Incident SharePoint ToolShell attacks In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell. July 2025 · Multiple sectors
- Incident South African Department of Justice ransomware attack, 2021 On the evening of 6 September 2021 ransomware encrypted the IT systems of South Africa's Department of Justice and Constitutional Development. September 2021 · Government and public sector
- Incident STJ court ransomware attack, Brazil, 2020 On 3 November 2020 a ransomware attack hit the network of Brazil's Superior Court of Justice (STJ) during judgment sessions. November 2020 · Government and public sector
- Incident Transnet port systems ransomware attack, 2021 On Thursday 22 July 2021 Transnet, South Africa's state-owned ports and freight company, suffered an IT security breach that it later said was a ransomware attack. July 2021 · Transport and manufacturing
- Incident WannaCry ransomware attack on the NHS in England On Friday 12 May 2017 the WannaCry ransomware, released worldwide, locked computers across the NHS in England. May 2017 · Healthcare
How to detect
-
Bursts of file changes
Many file writes in a short time, often with unusual file extensions, followed by ransom note creation in several folders.
-
Tampering with recovery options
Registry changes or deletion of shadow copies near the time files are being changed can point to encryption under way.
-
Virtual machine and cloud storage activity
Watch for encryption or overwriting of virtual machine files on hypervisors, and for cloud storage objects replaced with encrypted versions.
-
Detection strategy MITRE lists
DET0215, Detection of Multi-Platform File Encryption for Impact.
How to defend
-
Keep tested backups off system
Have disaster recovery plans with regular, tested backups. Store them away from the systems they protect, and protect them from attackers who try to destroy them. Turn on versioning in cloud storage.
-
Block ransomware-like behavior on endpoints
On Windows 10, enable cloud-delivered protection and Attack Surface Reduction rules to block files that resemble ransomware.
-
Restrict customer-provided encryption keys in the cloud
In AWS environments, use an IAM policy to restrict or block SSE-C on S3 buckets.
Questions
What is Data Encrypted for Impact?
Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. It is the core step of ransomware and an Impact technique.
What gets encrypted in these attacks?
Common user files such as documents, PDFs, images, videos, audio, text and source code are usually encrypted. Some attacks also encrypt system files, disk partitions or virtual machines on hypervisors such as ESXi, and cloud storage objects.
How can I detect ransomware encryption?
Look for many file writes in a short time with unusual file extensions, followed by ransom notes in several folders. Registry changes or deleted shadow copies near that time can also point to encryption under way.
How do I defend against Data Encrypted for Impact?
Keep regular, tested backups stored away from the systems they protect, and turn on versioning in cloud storage. On Windows 10, enable cloud-delivered protection and Attack Surface Reduction rules to block files that resemble ransomware.
In our research
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- ATT&CK groups by attributed origin: what is mapped October 2026
- Ransomware Trends Report | Q3 2026 October 2026
- Agentic Ransomware: What Happens When Malware Doesn’t Need a Human Operator to Decide Who to Hit Next? September 2026
- Hunters International Ransomware Technical Analysis February 2026
- VanHelsing: Inside the Rise of a Multi‑Platform RaaS Threat Actor January 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.