MalwareUsed by 1 actor

Atomsilo

AtomSilo is a Windows ransomware family that emerged around September 2021. Its operators use double extortion, encrypting victims’ files and threatening to publish stolen data. The ransomware is a 64-bit executable, with analyzed samples packed using a modified UPX packer. It enumerates drives, recursively traverses directories, and excludes selected system directories, filenames, and executable-related file types. It uses AES for file encryption and RSA to protect associated key material, storing encrypted key information with affected files. Analyzed variants perform partial file encryption through memory mapping. The payload uses a mutex to prevent simultaneous instances and places ransom notes in affected directories.

Observed AtomSilo intrusions began with exploitation of vulnerable Atlassian Confluence servers. Operators subsequently installed a backdoor through DLL side-loading and used compromised administrative accounts and WMI to execute Windows commands before deploying the ransomware. Microsoft identified AtomSilo among the ransomware families previously deployed by the China-based operator DEV-0401. HUI Loader variants have also appeared in operations involving AtomSilo. Victims have included a Brazilian pharmaceutical company whose stolen data was published by the operators. Avast released a free AtomSilo decryptor in October 2021.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Cinnamon Tempest

DEV-0401 has previously deployed multiple ransomware families including LockFile, AtomSilo, and Rook.

via microsoft generalmicrosoft.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

operators exploited using compromised administrative accounts before dropping AtomSilo

T1190Exploit Public-Facing ApplicationEvidence1

the attack, which started with initial access through exploiting a vulnerability in Atlassian’s Confluence collaboration software

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

The backdoor allowed remote code execution of Windows Shell commands through WMI (Windows Management Interface)

T1129Shared ModulesEvidence1

AtomSilo uses a simple hybrid cryptographic approach using RSA and AES from the CryptoPP library to encrypt files.

Persistence

2 techniques

T1078Valid AccountsEvidence1

operators exploited using compromised administrative accounts before dropping AtomSilo

T1543Create or Modify System ProcessEvidence1

AtomSilo attempts to use multithreading to speed up traversing and encrypting files on the system. It iterates through a list of drive names from 'a:' to 'z:' and spawns a new thread to encrypt each.

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

operators exploited using compromised administrative accounts before dropping AtomSilo

T1543Create or Modify System ProcessEvidence1

AtomSilo attempts to use multithreading to speed up traversing and encrypting files on the system. It iterates through a list of drive names from 'a:' to 'z:' and spawns a new thread to encrypt each.

Stealth

3 techniques

T1070.004File DeletionEvidence2

Since the victim’s public key is required to decrypt files later, AtomSilo clears it out in memory after encrypting and storing the result to avoid the key being recovered from memory.

T1078Valid AccountsEvidence1

operators exploited using compromised administrative accounts before dropping AtomSilo

T1497Virtualization/Sandbox EvasionEvidence2

AtomSilo calls CreateMutexA to check if the mutex with name “8d5e957f297893487bd98fa830fa6413” already exists, and if it does, the malware exits immediately.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence2

Each thread uses DFS to traverse a directory being passed into it. First, to look for all files and subdirectories, it uses the standard API calls FindFirstFileA and FindNextFileA.

T1497Virtualization/Sandbox EvasionEvidence2

AtomSilo calls CreateMutexA to check if the mutex with name “8d5e957f297893487bd98fa830fa6413” already exists, and if it does, the malware exits immediately.

Impact

1 technique

T1486Data Encrypted for ImpactEvidence3

It enumerates each file and encrypts all folders and files... Ransomware appends “.atomsilo” extensions to files after encryption.

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app9 months ago

hash.md5●●●●●●●●●●●●View more in app5 years ago

domain●●●●●●●●●●●●View more in app5 years ago

email●●●●●●●●●●●●View more in app5 years ago

hash.md5●●●●●●●●●●●●View more in app5 years ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

ahnlab asec blogNews

Feb 25, 2026

Ransom & Dark Web Issues Week 4, Fabruary 2026 - ASEC

Ransomware operation that has resumed activity and is disclosing new victims.

zscaler threat labzNews

Jan 1, 2026

AtomSilo Ransomware Enters the League of Double Extortion | Zscaler

Ransomware that encrypts files, appends the .atomsilo extension, drops ransom notes, and is used in double-extortion attacks involving data exfiltration and publication on a leak site.

sentinelone labsNews

Apr 11, 2025

Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector | SentinelOne

AtomSilo is a ransomware family associated in the report with HUI Loader-enabled operations and BRONZE STARLIGHT-linked activity.

security affairsNews

Feb 7, 2022

Avast released a free decryptor for TargetCompany ransomware

Referenced only as another ransomware family for which Avast released a decryptor.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Atomsilo