Dissecting Mamba, the Disk-Encrypting Ransomware

Another new ransomware has joined the file-encrypting bandwagon. Only this time, instead of choosing what types of files to encrypt, it has decided to join the league of a few others and encrypt the entire disk directly using an open-source tool called DiskCryptor.

This is not the first time that disk-encrypting ransomware has hit the spotlight. Earlier this year, Petya ransomware wreaked havoc by encrypting disks through the master file table (MFT), denying access to user files. Unlike that former attack, however, this new ransomware fully encrypts the entire disk, including its data, leaving the system totally unusable unless a ransom is paid. Fitting to its capability to incapacitate systems, it has been named after a venomous snake, the Mamba.

Fortinet Blog