Netwalker

Executive Summary

NetWalker is a Windows‑only, fileless ransomware that runs entirely in memory via PowerShell. It targets user documents and other files, encrypts them using an embedded RSA key pair, and then deletes shadow copies to hinder recovery. Its use of encoded PowerShell scripts and remote credential dumping makes it difficult to detect with signature‑based defenses.

NetWalker is a Windows‑only, fileless ransomware discovered in May 2020 by TrendMicro. The malware is written entirely in PowerShell and is executed directly from memory, leaving no malicious files on disk until the final stage of the attack. By operating in this manner it evades traditional signature‑based antivirus engines and simplifies sandbox detection, making NetWalker a potent threat for corporate environments. Once active, NetWalker enumerates target directories—typically user documents, spreadsheets, PDFs and other proprietary file types—and encrypts them using an asymmetric RSA key pair embedded in the script. The private key is never written to disk; instead it is kept only in memory during the encryption process. To prevent recovery from backups, the malware actively disables or deletes Windows shadow copies and may remove event‑logging entries that could provide forensic evidence. Beyond its cryptographic payload, NetWalker has been documented to leverage PowerShell modules for credential dumping, to establish rudimentary persistence via scheduled tasks or registry run keys, and to propagate laterally across SMB shares by exploiting shared credentials. Its extensive use of encoded PowerShell commands also makes it difficult to parse with traditional text‑based security solutions. The end result is a classic ransomware scenario: all encrypted files are rendered inaccessible, the victim receives a ransom note demanding payment in cryptocurrency, and any evidence of the attack is largely removed from the system. Given its fileless architecture and targeted evasion techniques, NetWalker highlights the need for behavioral detection capabilities and hardened backup strategies.

Key Capabilities

• In‑memory execution using PowerShell scripts
• Fileless operation with no persistent malicious files left on disk until final payload stage
• Targeted encryption of user documents, spreadsheets, PDFs and other proprietary file types
• Encryption performed via embedded asymmetric RSA key pair and symmetric AES cipher derived from a random passphrase
• Deletion or disabling of Windows Shadow Copies to block backup recovery
• Credential dumping through PowerShell modules for lateral movement over SMB shares
• Establishment of rudimentary persistence using scheduled tasks or registry run keys
• Use of encoded PowerShell commands to evade detection by signature‑based tools

ATT&CK Techniques

Recommended Actions

• Implement real‑time monitoring for anomalous PowerShell execution, particularly scripts containing Base64‑encoded payloads
• Enforce strict PowerShell logging and enable Constrained Language Mode to limit script capabilities on endpoints
• Maintain regular, versioned backups stored offline or in immutable storage, and configure Windows policies to keep shadow copies from being deleted
• Deploy an Endpoint Detection & Response solution that detects fileless attacks via memory analysis, anomalous file encryption patterns, and process injection
• Restrict SMB 1.0 usage, disable unused remote services (such as RDP), and enforce least‑privilege principles for user accounts
• Use multi‑factor authentication for privileged accounts to mitigate credential‑based lateral movement
• Block outbound connections to known cryptocurrency exchanges or sandbox the payment process to disrupt ransomware finance channels
• Educate staff on phishing awareness and conduct regular simulated phishing campaigns

Suggested Tags