Loading malware…
BackMyData is a ransomware strain identified as a variant of the Phobos ransomware family. It was used in the February 2024 ransomware attack that disrupted Romanian hospitals via the Hippocrates/Hipocrate hospital management system after attackers compromised Bucharest-based software provider RSC. The campaign affected more than 100 healthcare facilities that disconnected systems as a containment measure, with authorities later confirming direct infection in at least 25-26 hospitals. The malware encrypted hospital files and databases and demanded ransom in Bitcoin; reporting cited demands of 3.5 BTC, roughly €157,000-€160,000. Impacted hospitals lost access to digital workflows and reverted to paper-based processes for admissions, prescriptions, records, lab requests, radiology, medicines, and supplies. Romanian authorities stated there was no evidence of data theft at the time of reporting and advised victims not to pay; most affected hospitals restored operations from backups within days.
Technical reporting on an analyzed sample (SHA-256: 396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6) describes BackMyData as storing an encrypted configuration protected by a hard-coded AES key and using an embedded RSA public key to wrap per-file AES-256 keys. It implements AES internally, checks locale settings and avoids systems associated with Cyrillic alphabets, and uses mutexes derived from a BID value and the volume serial number. The malware resolves APIs dynamically, disables file system redirection, duplicates the explorer.exe token, and respawns itself in that security context. It establishes persistence by copying itself to %AppData%\Local, creating Run registry entries under HKLM\Software\Microsoft\Windows\CurrentVersion\Run (with HKCU Run also noted as an IOC location), and placing itself in the Startup folder. It executes commands to delete Volume Shadow Copies, disable automatic repair, delete the backup catalog, and disable the Windows firewall.
BackMyData enumerates logical drives, network resources, and local IPv4 addresses, attempts TCP connections to hosts on port 445 to reach network shares, and uses multiple worker threads for traversal and encryption. It enables SeDebugPrivilege and terminates processes including sqlservr.exe, oracle.exe, mysqld.exe, outlook.exe, winword.exe, excel.exe, thunderbird.exe, and steam.exe to unlock files. It skips selected files and directories, including info.hta, info.txt, boot.ini, bootfont.bin, ntldr, ntdetect.com, io.sys, backm, C:\WINDOWS, and C:\ProgramData\microsoft\windows\caches, and avoids re-encrypting files associated with other ransomware extensions. Files smaller than 1.5 MB are fully encrypted, while larger files are partially encrypted. Encrypted filenames receive a .backmydata extension together with the volume serial number and threat actor email address. Each encrypted file contains an unencrypted 16-byte IV, an RSA-encrypted AES key, and the 6-byte marker DD F9 CC F5 B3 44. The ransomware drops ransom notes named info.txt and info.hta and instructs victims to contact the operators via email or Session messenger.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
The DuplicateTokenEx API is utilized to create a new access token... The ransomware spawns itself running in the security context of the newly created token.
The DuplicateTokenEx API is utilized to create a new access token that duplicates the token mentioned above... The ransomware spawns itself running in the security context of the newly created token.
The unencrypted file is overwritten with zeros and deleted afterwards.
The DuplicateTokenEx API is utilized to create a new access token... The ransomware spawns itself running in the security context of the newly created token.
The malware takes a snapshot of all processes in the system... The processes are enumerated using the Process32FirstW and Process32NextW APIs.
The malware extracts the major and minor version numbers of the operating system using the GetVersion method.
The files are enumerated using the FindFirstFileW and FindNextFileW methods.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware used to encrypt data in Romanian hospitals after attackers leveraged the Hippocrates hospital management system as the distribution vector.
Ransomware that encrypted hospital files and demanded a Bitcoin ransom to restore access. It was used in the February 2024 attack affecting Romanian hospitals via the compromised Hippocrates platform.
Ransomware that encrypts files and demands payment in bitcoin.
Ransomware that encrypts files and demands payment in bitcoin.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.