Troldesh orShade, XTBL
Aliases: Shade, Troldesh
- First seen
- 2014-12-15 00:00:00
- Malware type
- ransomware, downloader
- Family
- Malware family
- Last IoC activity
- 2026-07-22 01:55:25
- Profile updated
- 2026-07-07 13:40:19
Targeted industries: financial-services healthcare-and-pharmaceutical government-and-public-sector
Targeted regions: country_code:ru country_code:us country_code:de
Context
Ransomware May download additional malware after encryption
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Troldesh_Auto (yara-rule)
Reports & references
- nomoreransom.org — Shadedecryptor How To Guide (report)
- nyxbone.com — Troldesh (report)
- bleepingcomputer.com — Kelihos Botnet Delivering Shade Troldesh Ransomware With No More Ransom Extension (report)
- id-ransomware.blogspot.com — Troldesh Ransomware Email (report)
- ransomlook.io — Shade (report)
- Kaspersky — 72087 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Troldesh (report)
- blog.avast.com — Ransomware Strain Troldesh Spikes (report)
- zdnet.com — Shade Troldesh Ransomware Shuts Down And Releases All Decryption Keys (report)
- support.kaspersky.com — 13059 (report)
- Microsoft — Troldesh Ransomware Influenced By The Da Vinci Code (report)
- Palo Alto Unit 42 — Shade Ransomware Hits High Tech Wholesale Education Sectors In U S Japan India Thailand Canada (report)
- labs.bitdefender.com — Shade Troldesh Ransomware Decryption Tool (report)
- blog.checkpoint.com — Troldesh New Ransomware From Russia (report)
- ESET — Russia Hit New Wave Ransomware Spam (report)
- github.com — Keys (report)
- isc.sans.edu — 24668 (report)