VaultCrypt

Aliases: CrypVault, Zlader, Russian, VaultCrypt

First seen
2015-02-01 00:00:00
Malware type
ransomware
Family
Malware family
Last IoC activity
2026-07-21 10:03:41
Profile updated
2026-07-07 15:43:15

Context

VaultCrypt is a type of ransomware that encrypts user files and demands a ransom payment for decryption. Also known as CrypVault and Zlader, it is known for disguising the ransom notes and other artifacts as legitimate system files to evade detection.

Detection coverage

  • 2 YARA rules

Used by threat actors

  • APT29 Cloud TTP Evolution (campaign)
  • BadPilot (campaign)
  • Midnight Blizzard RDP File Spearphishing Campaign (campaign)
  • Russian SVR Cyber Operations and Vulnerability Exploitation Activity (campaign)
  • Unit 26165 Russian Military Cyber Activity (campaign)
  • Unit 29155 Russian Military Cyber Activity (campaign)

Detection rules

  • ARKBIRD_SOLG_MAL_Unknown_PE_Jul_2021_1 (yara-rule)
  • SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1 (yara-rule)

Reports & references

  • nyxbone.com — Russianransom (report)
  • ransomlook.io — Vaultcrypt (report)

External references