Khonsari

Malware type
ransomware
Last IoC activity
2026-07-06 12:56:41
Profile updated
2026-07-07 13:03:13

Targeted industries: technology-and-telecommunications retail-and-hospitality financial-services

Context

A compact ransomware written in .NET and delivered as follow-up to Log4J exploitation, targeting Windows servers.

Detection coverage

  • 1 YARA rules

Exploited vulnerabilities

  • CVE-2021-44228 (vulnerability)

Detection rules

  • DITEKSHEN_MALWARE_Win_Khonsari (yara-rule)

Reports & references

  • Microsoft — Guidance For Preventing Detecting And Hunting For Cve 2021 44228 Log4J 2 Exploitation (report)
  • assets.virustotal.com — 2021Trends (report)
  • Broadcom/Symantec — Log4J Vulnerabilities Attacks (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Khonsari (report)
  • cloudsek.com — Technical Analysis Of Khonsari Ransomware Campaign Exploiting The Log4Shell Vulnerability (report)
  • cadosecurity.com — Analysis Of Novel Khonsari Ransomware Deployed By The Log4Shell Vulnerability (report)

External references