Blog's Page
Blog's Page
SamSam Is A Notorious Ransomware Family That Emerged In The Mid-2010s And Became Particularly Significant Because Of Its Targeted, Hands-on Approach To Compromising Organizations. Unlike Conventional Ransomware Campaigns That May Distribute Malicious Attachments Or Links To Thousands Of Users, SamSam Operators Typically Established Access To An Organization's Network First And Then Deliberately Deployed Ransomware Across Selected Systems. MITRE ATT&CK Identifies SamSam As Malware S0370, Associated With The Name Samas, And Describes It As Windows Ransomware That Appeared In Early 2016.
SamSam Became Widely Known After Attacks Affected Hospitals, Municipalities, Educational Institutions, Healthcare Organizations, Businesses, And Other Public-sector Environments. The U.S. Department Of Justice Stated In 2018 That The Campaign Caused More Than $30 Million In Losses And Generated More Than $6 Million In Extortion Payments, According To The Indictment And Government Statements At The Time.
The Importance Of SamSam Goes Beyond Its Individual Malware Components. It Demonstrated An Important Evolution In Ransomware: Attackers Could First Compromise A Network, Obtain Administrative Privileges, Conduct Reconnaissance, Move Laterally, And Only Then Execute Ransomware. This Approach Made Ransomware A Complete Intrusion Operation Rather Than Simply A Malicious File Delivered To An Individual Computer.
SamSam Is A Windows-based Ransomware Family Designed To Encrypt Files And Disrupt The Operation Of Compromised Systems. It Is Also Known As Samas And SamsamCrypt In Security Research. MITRE ATT&CK Records SamSam As Malware Associated With Several Techniques, Including Windows Command-shell Execution, Data Encryption For Impact, File Deletion, And Obfuscation.
SamSam Is Particularly Notable Because The Attackers Generally Interacted Manually With Compromised Environments. MITRE Notes That Some Core Components Of SamSam Required Operator Interaction Rather Than Being Completely Automated.
This Characteristic Made SamSam Different From Many Traditional Ransomware Campaigns. Instead Of Relying Exclusively On Mass Distribution, Operators Could Spend Time Understanding A Victim's Infrastructure Before Launching The Encryption Stage.
Security Researchers Began Tracking SamSam-related Activity In The 2015–2016 Period. Sophos Reports That Its Researchers Associated The Campaigns With The Threat Group It Calls GOLD LOWELL, While Also Noting Uncertainty Around Attribution Because The Operators Used Publicly Available Tools And Services.
The U.S. Department Of Justice Stated That The Individuals Charged In The 2018 Case Allegedly Began Accessing Victims' Computers In December 2015 And Subsequently Installed SamSam Ransomware.
Over The Following Years, SamSam Attacks Demonstrated How Ransomware Could Be Integrated Into A Broader Intrusion Lifecycle. Attackers Could Exploit Exposed Systems, Obtain Credentials, Investigate The Internal Network, Move Between Machines, And Finally Deploy Ransomware.
This Operational Model Influenced The Broader Evolution Of Ransomware. Sophos Describes The Mid-2010s As A Period When Ransomware Shifted Toward post-intrusion Deployment, In Which Attackers First Obtained Access And Subsequently Deployed Ransomware Against Selected Systems.
One Of The Defining Characteristics Of SamSam Was Its Focus On Organizations Rather Than Indiscriminate Attacks Against Individual Users.
Sophos Research Indicates That SamSam-related Operators Frequently Targeted Internet-facing Systems And Technologies Such As JBoss And Remote Desktop Protocol (RDP). The Attackers Could Use Vulnerabilities Or Compromised Credentials To Establish An Initial Foothold.
Once Inside A Network, The Operators Could Spend Considerable Time Identifying Important Systems And Accounts. This Allowed Them To Maximize The Disruption Produced When Ransomware Was Eventually Deployed.
The Targeted Nature Of SamSam Attacks Also Meant That Organizations Could Be Compromised For An Extended Period Before Encryption Occurred. Security Teams Therefore Needed To Detect The Intrusion Phase Rather Than Relying Solely On Ransomware Detection.
SamSam Campaigns Used Multiple Techniques For Gaining Access. Historical Investigations Identified Exploitation Of Vulnerable Internet-facing Applications As One Initial-access Method. Sophos Researchers Reported That Early Campaigns Frequently Exploited Vulnerable JBoss Systems Using JexBoss.
Later Activity Also Involved Attacks Against RDP Accounts. Researchers Observed Brute-force Attempts Against Internet-facing RDP Services And The Subsequent Use Of Legitimate Credentials.
This Provides An Important Cybersecurity Lesson: An Organization Can Become Vulnerable To Ransomware Without An Employee Necessarily Opening A Malicious Attachment. Weak Passwords, Exposed Remote Services, Unpatched Applications, And Poorly Protected Administrative Accounts Can Provide Attackers With Alternative Entry Points.
Vulnerability Exploitation Was An Important Component Of Historical SamSam Campaigns. Internet-facing Applications Represent A Particularly Valuable Target Because They Can Provide Attackers With A Direct Route Into An Organization's Environment.
In Early Campaigns, JBoss Application Servers Were Among The Systems Targeted. Attackers Could Exploit Vulnerable Deployments And Establish Web Shells That Provided Command Execution Capabilities. Sophos Describes JexBoss As One Of The Tools Observed In These Intrusions.
This Illustrates Why Vulnerability Management Is An Essential Ransomware-defense Strategy. A Security Program Should Not Only Identify Vulnerabilities But Also Determine Whether Vulnerable Services Are Accessible From The Public Internet.
Remote Desktop Protocol Played An Important Role In Some SamSam-related Intrusions. Researchers Documented Attempts To Compromise RDP Credentials, Including Brute-force Activity.
Once Legitimate Credentials Are Obtained, Attackers May Appear More Like Authorized Users Than Conventional Malware. This Can Make Detection More Difficult Because Activities Such As Remote Login, Administrative Commands, And Network Access Can Resemble Legitimate IT Administration.
Modern Security Programs Therefore Benefit From Monitoring Authentication Anomalies, Unusual Geographic Access, Repeated Failed Logins, Privileged-account Activity, And Unexpected Remote Sessions.
After Gaining An Initial Foothold, SamSam Operators Could Attempt To Increase Their Privileges. Sophos Reports That Researchers Observed The Use Of Mimikatz To Obtain Credentials From Memory During Historical SamSam Intrusions.
The Objective Of This Stage Was To Obtain Credentials That Could Provide Access To Additional Machines Or Privileged Accounts.
Privilege Escalation Is Particularly Dangerous In Ransomware Incidents Because Administrative Access Can Dramatically Increase The Potential Blast Radius. An Attacker With Sufficient Privileges May Be Able To Access File Servers, Domain Resources, Backups, Security Tools, And Other Infrastructure.
Before Deploying Ransomware, Attackers Need To Understand The Environment They Have Compromised. SamSam-related Operators Performed Network Discovery And Enumeration To Identify Additional Computers And Important Resources.
Sophos Documented The Use Of Tools Such As Hyena, Scripts, Active Directory-related Utilities, And Other Administrative Tools For Network Reconnaissance.
Network Discovery Can Include Identifying Hostnames, IP Addresses, Domain Information, Users, Operating Systems, Shared Folders, And Accessible Systems.
For Defenders, Unusual Network Enumeration From A Workstation Or Server Can Therefore Represent An Important Warning Sign.
Lateral Movement Is The Process Of Moving From One Compromised Computer To Another. SamSam Operators Used Administrative And Remote-execution Mechanisms During Historical Campaigns.
Sophos Documented The Use Of Tools Including PsExec, WMI-based Execution, SMB-related Activity, And Remote Desktop During SamSam Intrusions.
This Behavior Allowed Attackers To Position Themselves Across Multiple Systems Before Initiating Ransomware Deployment.
From A Defensive Perspective, Organizations Should Monitor Unusual Administrative Connections Between Systems, Unexpected Remote Execution, Abnormal SMB Activity, And Suspicious Use Of Administrative Tools.
The Encryption Stage Is The Core Destructive Component Of SamSam. MITRE ATT&CK Reports That SamSam Uses RSA-2048 Encryption As Part Of Its File-encryption Process.
Sophos' Technical Analysis Describes A More Detailed Encryption Process In Which A Randomly Generated Symmetric Key Is Used For File Encryption And That Key Is Subsequently Protected Using An RSA-2048 Public Key.
This Type Of Hybrid Encryption Is Practical For Ransomware Because Symmetric Encryption Is Efficient For Processing Large Amounts Of Data, While Asymmetric Encryption Can Protect The Symmetric Key From Straightforward Recovery.
The Result Is That Victims May Lose Access To Important Documents, Databases, Applications, And Other Business Data.
SamSam Did Not Necessarily Encrypt Every File Indiscriminately. Sophos Researchers Reported That Historical Versions Contained A Hard-coded List Of Approximately 300 File Extensions And Categorized Files According To Size During The Encryption Process.
Targeting Valuable Business-related Files Increases Operational Disruption. Documents, Databases, Spreadsheets, Archives, Project Files, And Other Organizational Data Can Be Particularly Important.
This Behavior Demonstrates Why Ransomware Protection Must Include Critical Data Identification And Resilient Backup Strategies.
SamSam Also Incorporated Techniques Intended To Make Recovery And Forensic Analysis More Difficult. MITRE Records File Deletion As One Of Its Techniques And Notes That SamSam Has Been Observed Deleting Its Own Files And Payloads.
Sophos Additionally Documented The Use Of SDelete And Other Deletion Mechanisms During Historical Campaigns.
This Means That Ransomware Defense Should Not Focus Solely On Detecting Encrypted Files. Organizations Should Also Monitor Suspicious Deletion Of Backups, Security Tools, Temporary Files, Logs, And Other Recovery-related Resources.
After Encryption, SamSam Displayed An Extortion Message Demanding Payment In Cryptocurrency. Historical Campaigns Provided Victims With Instructions For Communicating With The Attackers And Making Ransom Payments.
The U.S. Department Of Justice Reported That The SamSam Campaign Involved Extortion Against Hospitals, Municipalities, Public Institutions, And Businesses.
The Economic Impact Was Therefore Not Limited To Ransom Payments. Organizations Could Experience Downtime, Emergency Recovery Expenses, Lost Productivity, Service Disruption, Legal Costs, And Reputational Consequences.
SamSam Affected Organizations Across Several Sectors. Government Sources Identified Victims Including The City Of Atlanta, City Of Newark, Port Of San Diego, MedStar Health, LabCorp, And Other Organizations.
The FBI Also Reported That SamSam Affected Victims In Nearly Every U.S. State And Described Attacks Involving Hospitals, Municipalities, And Major Healthcare Organizations.
One Particularly Well-known Incident Was The 2018 City Of Atlanta Attack. According To The U.S. Department Of Justice, Approximately 3,789 Computers Associated With The City Were Affected, Including Servers And Workstations.
These Incidents Demonstrated That Ransomware Can Disrupt Public Services As Well As Private Businesses.
A Simplified SamSam Attack Lifecycle Can Be Represented As:
Initial Access → Credential Compromise → Privilege Escalation → Network Discovery → Lateral Movement → Target Identification → Ransomware Deployment → File Encryption → Extortion
This Lifecycle Is Important Because Defenders Can Potentially Stop An Attack At Multiple Stages.
For Example, Vulnerability Management Can Reduce Initial Access Opportunities. Multi-factor Authentication Can Make Stolen Passwords Less Useful. Network Segmentation Can Limit Lateral Movement. Endpoint Detection Can Identify Suspicious Administrative Behavior. Offline Or Immutable Backups Can Reduce The Consequences Of Successful Encryption.
MITRE ATT&CK Currently Associates SamSam With Several Techniques. These Include:
T1059.003 — Windows Command Shell
T1486 — Data Encrypted For Impact
T1070.004 — File Deletion
T1027.013 — Encrypted/Encoded File
T1027.016 — Junk Code Insertion
These Mappings Help Security Professionals Understand SamSam Behavior In The Context Of A Standardized Adversary-technique Framework.
Potential Indicators Of A SamSam-style Intrusion Can Include:
Repeated Failed RDP Authentication Attempts
Suspicious Successful Remote Logins
Unexpected Administrative Accounts
Unusual PowerShell Or Command-shell Activity
Credential-dumping Activity
Abnormal SMB Connections
Unexpected PsExec Or WMI Activity
Large-scale Internal Network Enumeration
Unexpected Security-tool Modification
Suspicious Deletion Of Files Or Backups
Rapid Encryption Of Large Numbers Of Files
New Ransom-note Files Or HTML Documents
Sudden Changes To File Extensions Or File Accessibility
These Indicators Are Not Necessarily Unique To SamSam. Many Legitimate Administration Tools Can Be Abused By Attackers, So Detection Should Consider Context, User Identity, Timing, Host Behavior, And Other Telemetry.
Organizations Should Adopt A Layered Detection Strategy. Endpoint Detection And Response (EDR) Systems Can Monitor Suspicious Process Execution, Credential-access Behavior, Command-line Activity, And Abnormal File Modifications.
Network Monitoring Can Identify Unusual RDP Connections, SMB Activity, Lateral Movement, And Internal Reconnaissance.
Identity Monitoring Is Equally Important. Organizations Should Investigate Unexpected Administrative Logins, Impossible Travel Patterns, Abnormal Authentication Times, Repeated Authentication Failures, And Unusual Privileged-account Behavior.
Security Information And Event Management (SIEM) Platforms Can Combine Endpoint, Authentication, Firewall, DNS, Active Directory, And Network Telemetry To Identify Multi-stage Attacks.
The Following Security Measures Can Reduce Ransomware Risk:
Apply Security Updates Quickly To Externally Accessible Applications, Operating Systems, VPN Appliances, Remote-access Systems, And Enterprise Applications.
Avoid Exposing RDP Directly To The Public Internet Where Possible. Use VPN Or Zero-trust Access Mechanisms, Strong Authentication, Network Restrictions, And Multi-factor Authentication.
Privileged Accounts Should Have Strong, Unique Credentials And MFA Wherever Supported.
Users And Applications Should Receive Only The Permissions Necessary To Perform Their Functions.
Network Segmentation Can Limit An Attacker's Ability To Move From An Initially Compromised System To Critical Servers And Databases.
Maintain Multiple Backups And Ensure That At Least Some Recovery Copies Are Isolated From Ordinary Administrative Credentials And Ransomware-accessible Systems.
Sophos Specifically Recommends Resilient Backup Solutions And Regularly Tested Response Plans As Part Of Defenses Against SamSam-style Attacks.
Tools Such As PowerShell, WMI, PsExec, And Remote Administration Utilities Can Have Legitimate Purposes, But Unexpected Use Should Be Investigated.
Network Monitoring Can Reveal Unusual Scanning, Authentication Attempts, Lateral Movement, And Communication Between Systems That Normally Do Not Interact.
If Ransomware Activity Is Detected, Organizations Should Prioritize Containment And Evidence Preservation.
Potential Immediate Actions Include Isolating Affected Systems From The Network, Disabling Compromised Accounts When Appropriate, Protecting Unaffected Backup Infrastructure, And Engaging The Organization's Incident-response Team.
Security Teams Should Preserve Relevant Logs And Forensic Evidence Rather Than Immediately Wiping Affected Systems. Identifying The Initial Access Vector Is Essential Because Removing The Ransomware Without Eliminating The Attacker's Access May Allow Reinfection.
Organizations Should Also Coordinate With Legal, Compliance, Executive, And Law-enforcement Teams As Appropriate.
Ransom Payment Is An Organizational Risk-management And Legal Issue Rather Than A Simple Technical Decision. Payment Does Not Guarantee Successful Recovery, And It Does Not Necessarily Remove The Underlying Compromise.
Organizations Should First Determine The Scope Of The Incident, Identify Available Backups, Assess Legal And Regulatory Considerations, And Involve Qualified Incident-response And Legal Professionals.
The FBI Has Repeatedly Emphasized Reporting Ransomware Incidents And Working With Law Enforcement. Historical SamSam Investigations Demonstrate The Importance Of Cooperation Among Victims, Private-sector Security Researchers, And Government Agencies.
SamSam Provides Several Important Lessons For Modern Cybersecurity. First, Ransomware Is Not Always An Isolated Malware Infection. It Can Be The Final Stage Of A Broader Intrusion.
Second, Protecting Only Endpoints Is Insufficient. Organizations Must Also Protect Identities, Remote-access Infrastructure, Applications, Networks, Backups, And Administrative Interfaces.
Third, Early Detection Is Critical. An Attacker Who Remains Inside A Network For Weeks Can Potentially Gather Credentials And Understand The Infrastructure Before Deploying Ransomware.
Finally, Resilient Backups And Tested Incident-response Procedures Can Significantly Improve An Organization's Ability To Recover From Ransomware.
The Historical SamSam Campaign Is No Longer Considered An Active Ransomware Family In The Same Way As Many Contemporary Ransomware Operations. The FBI Stated That After Law-enforcement Actions In 2018, The SamSam Variant Had Not Been Seen Since.
However, SamSam Remains Highly Relevant For Cybersecurity Education Because Its Techniques Helped Demonstrate The Transition Toward Human-operated, Targeted Ransomware Operations.
Modern Ransomware Groups Continue To Use Some Of The Broader Concepts Seen In SamSam Campaigns, Including Compromised Credentials, Exploitation Of Exposed Services, Privilege Escalation, Lateral Movement, And Deployment Of Ransomware After Gaining Control Of A Network.
| Category | Details |
|---|---|
| Malware Type | Ransomware |
| Platform | Windows |
| MITRE ID | S0370 |
| Other Name | Samas |
| Emergence | Mid-2010s |
| Primary Impact | File Encryption And Operational Disruption |
| Encryption | Historical Versions Used Symmetric Encryption With RSA-2048 Key Protection |
| Common Access Methods | Vulnerability Exploitation And Compromised RDP Credentials |
| Lateral Movement | RDP, SMB, PsExec, WMI And Administrative Mechanisms |
| Target Profile | Organizations, Public Institutions, Healthcare And Businesses |
| Extortion Currency | Bitcoin In Historical Campaigns |
| Major Incident | City Of Atlanta, 2018 |
| Associated Threat-group Name In Sophos Research | GOLD LOWELL |
| Current Historical Status | FBI Reported The Variant Had Not Been Seen After 2018 |
Technical Details In The Table Are Based Primarily On MITRE ATT&CK, Sophos Research, And U.S. Government Records.
SamSam Ransomware Represents An Important Milestone In The Evolution Of Targeted Ransomware. Rather Than Simply Infecting Computers Through Mass-distributed Malicious Files, Its Operators Could First Compromise Organizational Infrastructure, Obtain Credentials, Perform Reconnaissance, Move Laterally, Identify Valuable Systems, And Then Manually Deploy Ransomware.
Its Historical Attacks Against Municipalities, Healthcare Organizations, Educational Institutions, Businesses, And Public-sector Systems Demonstrated How Ransomware Can Become An Enterprise-wide Cybersecurity Incident.
For Modern Organizations, The Most Important Lesson From SamSam Is That Ransomware Defense Must Address The entire Attack Lifecycle. Patch Management, Secure Remote Access, MFA, Least Privilege, Network Segmentation, Endpoint Monitoring, Centralized Logging, Protected Backups, Vulnerability Management, And Incident-response Planning All Contribute To Reducing Ransomware Risk.
Although The Original SamSam Campaign Is Historical, Its Operational Model Remains Valuable For Cybersecurity Researchers And Defenders Studying Human-operated Ransomware. Understanding SamSam Helps Security Professionals Recognize That The Visible Encryption Event May Be Only The Final Stage Of A Much Longer Compromise.
SamSam Ransomware, SamSam Malware, Samas Ransomware, SamSam Attack, SamSam Ransomware History, SamSam Ransomware Removal, SamSam Encryption, SamSam Ransomware Detection, SamSam Attack Methods, SamSam Cybersecurity, SamSam MITRE ATT&CK, Targeted Ransomware, Human-operated Ransomware, Ransomware Prevention, Ransomware Detection, Ransomware Protection, SamSam City Of Atlanta Attack, Ransomware Attack Lifecycle.
SamSam Ransomware, SamSam Malware, Samas Ransomware, SamSam Attack, SamSam Ransomware History, SamSam Ransomware Removal, SamSam Encryption, SamSam Ra
