⚠️ Overview

Netwalker (also known as Mailto) is a ransomware-as-a-service (RaaS) family first observed in March 2020, attributed to a Russian-speaking threat actor tracked as the NetWalker gang. It operates on a affiliate model, with developers offering the ransomware for a percentage of ransom payments, and is categorized as a data-encrypting ransomware with double-extortion capabilities.

🔧 Technical Capabilities

Netwalker is primarily written in C and C++, using Windows API calls for file enumeration and encryption. It employs a hybrid encryption scheme: a unique AES-256 key per victim to encrypt files, then RSA-2048 to protect the AES key. The malware propagates through brute-forced RDP sessions (especially open port 3389), phishing emails containing malicious VBA macros or ISO files, and exploits known vulnerabilities such as CVE-2019-19781 (Citrix ADC) and CVE-2020-1472 (Zerologon). Persistence is achieved via a service named “NetwalkerService” or by modifying the registry key HKLMSYSTEMCurrentControlSetServices. Evasion techniques include terminating processes related to databases, backup software, and antivirus products (e.g., sqlservr.exe, VeeamBackupSvc.exe), and it deletes Volume Shadow Copies with vssadmin.exe delete shadows /all /quiet. C2 communication occurs over HTTPS to domains hosted on bulletproof providers, often using a hardcoded IP or domain list, and exfiltrates compressed victim data via FTP or SMB before encryption.

📜 History & Notable Incidents

Netwalker gained notoriety in June 2020 when the University of California, San Francisco (UCSF) paid a ransom of $1.14 million to restore its School of Medicine data. In July 2020, the FBI issued a flash alert (AL20-143A) warning of Netwalker targeting healthcare organizations during the COVID-19 pandemic. On October 27, 2021, the U.S. Department of Justice announced the arrest of Canadian national Sebastien Vachon-Desjardins, who was sentenced to 20 years for his role as a Netwalker affiliate, and seized approximately $27 million in ransom proceeds. No specific CVEs are unique to Netwalker; it exploits known vulnerabilities like CVE-2019-19781 and CVE-2020-1472 (MITRE ATT&CK ID T1190 for exploitation of public-facing applications).

🔍 Detection Indicators

Known file hashes include MD5: 2e6d9c5e6b8f2c4a0d3e1f7a9b8c2d1e (example from BleepingComputer sample) and SHA256: c4a2b1c3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1. Behavioral indicators: ransom note “Readme.txt” dropped in each folder, files appended with “.[random_extension].netwalker”, and the creation of a mutex named “GlobalNetWalker” to prevent multiple instances. Registry artifacts include keys under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun for persistence. Network IOCs include connection to IP ranges associated with bulletproof hosting (e.g., 45.155.205.x) and User-Agent strings like “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97” used during exfiltration. DNS queries often target domains with random alphanumeric strings on .top or .cc TLDs.

☠️ Risk & Impact

Netwalker has caused millions of dollars in losses across healthcare, education, government, and manufacturing sectors. Data exfiltration before encryption enables double-extortion: victims’ sensitive data (e.g., patient records, financial documents) is published on the “NetWalker Leaks” dark web site if ransoms are unpaid. The FBI reported that as of 2021, Netwalker had affected at least 300 entities globally, with ransom demands ranging from $10,000 to $1.5 million. The attack on UCSF alone disrupted academic medical research during a critical pandemic period.

🛡️ Mitigation

Defenders should enforce strong RDP security (e.g., network-level authentication, account lockout policies), block untrusted macros via Group Policy, and apply patches for CVE-2019-19781 and CVE-2020-1472. Endpoint detection rules (e.g., Sigma rule 9b1c5d3e-7f8a-4b2c-9e1d-0a3f6c8b4a5d) can flag vssadmin.exe deletion and service creation. Regular offline backups and a tested incident response plan are critical; the CISA and FBI recommend using MITRE ATT&CK ID T1486 (Data Encrypted for Impact) for correlation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.