Shade Ransomware Hits High-Tech, Wholesale, Education Sectors in U.S, Japan, India, Thailand, Canada
Summary: Unit 42 reviewed Shade (Troldesh) ransomware activity in the first quarter of 2019 and found 307 samples across 6,536 sessions, with the top affected countries being the United States, Japan, India, Thailand, and Canada, while Russia ranked seventh. The ransomware, first seen in late 2014, has used the same Tor decryptor address since 2016 and encrypts files with the .crypted000007 extension, distributed through malspam carrying script-based files disguised as invoices.
What you should know: The top five victim countries are outside Russia and the former Soviet Union, and the most-attacked vertical was High-Tech - so the assumption that this family is a regional Russian problem does not match the 6,536 delivery sessions Unit 42 recorded.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026