Loading malware…
Mimic is a Windows ransomware family first publicly identified in 2022 and widely characterized as a Conti-derived encryptor that incorporates the legitimate Voidtools Everything search components to accelerate filesystem enumeration before encryption. It has been used directly by multiple financially motivated intrusion sets and has also served as the basis for later variants and derivative ransomware, including Elpaco and Pay2Key-related builds.
Mimic is typically packaged in multi-component archives, including self-extracting 7-Zip installers and password-protected inner payloads, and commonly deploys auxiliary tools alongside the encryptor. Observed supporting components include Everything binaries for rapid file discovery, utilities used to disable Microsoft Defender, secure deletion tools, and operator tooling for remote administration. Some builds expose a graphical operator interface that allows customization of ransom notes, encryption scope, exclusions, process termination, and command execution.
On execution, Mimic enumerates local files and shares, kills processes and services that may lock targeted data, and encrypts victim files at speed using multi-threaded routines. Reported variants use modern cryptography, including per-file key generation with asymmetric key exchange and ChaCha20-based file encryption. Certain builds support intermittent encryption for large files, while others maintain session state to resume interrupted encryption. Persistence has been observed in some variants through Windows Run keys and file-association changes that display ransom instructions.
Mimic has been deployed in intrusions against internet-exposed Microsoft SQL Server environments compromised through weak credentials, brute-force, or dictionary attacks. In these operations, attackers abused SQL Server functionality such as xp_cmdshell or the Bulk Copy Program to reconstruct and launch payloads on disk, then expanded access with remote administration tools, credential theft utilities, and lateral movement frameworks before manually deploying the ransomware across additional systems. Campaign reporting also links Mimic deployment to actors assessed as Turkish-speaking in some MSSQL-focused operations.
Victimology spans multiple regions and sectors, with observed targeting including organizations in the United States, Europe, Latin America, and Russia, as well as attacks affecting construction, consulting, engineering, retail, e-commerce, industrial, and healthcare environments through Mimic-derived ransomware. Mimic is best understood as both a standalone ransomware family and a reusable ransomware codebase that has enabled multiple affiliates and derivative operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In January 2024, the group first made its mark by deploying Trigona and Mimic ransomware on MS-SQL servers exposed to the internet with weak credentials.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
In the GUI, the operator can select entire drives for encryption, perform a process injection to hide malicious processes...
After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).
The most interesting artifact is svhostss.exe, which is the main console used by the malware. It is worth mentioning that this name closely mimics svchost.exe, a legitimate Windows process.
In the GUI, the operator can select entire drives for encryption, perform a process injection to hide malicious processes...
The folder that is ultimately installed not only contains Mimic ransomware and the Everything tool, but also... the SDelete tool (xdel.exe) of Sysinternals.
Another feature of Elpaco is that it deletes itself after encrypting files to evade detection and analysis. The last step in malware execution is calling the Del command to delete all executables... before deleting, the sample uses the fsutil LOLBin... to securely erase svhostss.exe
The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...
The commands that the threat actor first executes before creating the malware with BCP... are those that look up the infected system’s information as shown below. > hostname > whoami
The lineage is visible in the service and process kill lists. The encryptor terminates 60+ services and 40+ processes before encryption...
The commands that the threat actor first executes before creating the malware with BCP... > hostname > whoami > wmic computersystem get domain > wmic computersystem get totalphysicalmemory
Trigona ransomware is developed in Delphi and uses RSA and AES encryption algorithms when encrypting files... Mimic ransomware is known for exploiting a file search program called Everything while looking for files to encrypt.
The folder that is ultimately installed not only contains Mimic ransomware and the Everything tool, but also the Defender Control tool (DC.exe) for deactivating Windows Defender
For example, the DC.exe binary is the Defender Control tool for enabling and disabling Windows Defender. It is triggered by the sample once unpacked.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware manually deployed after MSSQL server compromise and lateral movement. In this campaign it was delivered as red25.exe, which extracted red.exe, used the legitimate Everything utility to locate files, encrypted hosts including the MSSQL server and domain controller, and dropped a ransom note.
Mimic5
Семейство вымогательского ПО, на котором основан Pay2Key.
Ransomware family and codebase derivative of Conti. The analyzed Pay2Key encryptor is built on Mimic and inherits features such as Everything-based file enumeration and other codebase elements.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.