DECAF
- First seen
- 2023-03-15 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 14:57:09
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Context
DECAF is a ransomware variant developed in Go, known for its robust encryption and ability to target critical infrastructure sectors. This malware family poses significant risks to financial, healthcare, and technology industries.
Detection coverage
- 4 YARA rules
Detection rules
- ARKBIRD_SOLG_RAN_Decaf_Nov_2021_1 (yara-rule)
- DITEKSHEN_MALWARE_Win_DECAF (yara-rule)
- DITEKSHEN_INDICATOR_KB_ID_Ransomware_DECAF (yara-rule)
- MALPEDIA_Win_Decaf_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Decaf (report)
- blog.morphisec.com — Decaf Ransomware A New Golang Threat Makes Its Appearance (report)