VGOD Ransomware Exposed: Actionable IOCs for Rapid Defense
VGOD Ransomware: Anatomy of a Backup-Killing Windows Extortion Strain VGOD is a Windows ransomware first seen in February 2025 that encrypts files, deletes Volume Shadow Copies to block recovery, and runs double extortion behind a ‘Decryption…
- Ransomware
Bottom line. Treat VGOD as a data-destruction event, not just encryption: it deletes shadow copies before it locks files and steals data before it encrypts. Prioritise offline/immutable backups and detection of shadow-copy deletion over any single indicator. The specific hash and domains from our automated triage are provisional leads, not confirmed VGOD infrastructure.
Background
VGOD surfaced in early 2025 and was first documented by CYFIRMA on 17 February 2025 (first observed 5 February) and independently analysed by Foresiet on 2 March 2025. It targets Windows, encrypts victim files, drops a ransom note titled ‘Decryption Instructions.txt’, changes the desktop wallpaper, and demands payment via email, a classic double-extortion model that also threatens to leak exfiltrated data.
The two public analyses disagree on internals, which suggests either distinct builds or an evolving toolset: CYFIRMA describes an AES-256 / RSA-4096 scheme that appends a ‘.Vgod’ extension, while Foresiet analysed a Golang build using ChaCha8 and AES that appends ‘.locked’. Both agree on the ransom-note name, the double-extortion pretext, and shadow-copy deletion. Reported infection vectors are the usual commodity set: phishing emails, brute-forced RDP, software exploits, malvertising and trojanised downloads. There is no known free decryptor.
What we observed
Across the two public analyses, the behavioural pattern is consistent and recovery-hostile:
- Encryption: files are locked with ChaCha8 + AES in the Golang build (or AES-256 / RSA-4096 per CYFIRMA) and renamed with a ‘.locked’ (or ‘.Vgod’) extension; originals are read, overwritten and deleted (CreateFile / ReadFile / WriteFile / DeleteFile) to frustrate carving.
- Recovery sabotage: VGOD runs ‘vssadmin.exe delete shadows /all’ or ‘wmic shadowcopy delete’ to remove Volume Shadow Copies before or during encryption, closing the most common local recovery path.
- EDR evasion: the Golang variant issues direct system calls (syscall.WriteFile) instead of standard APIs, and CYFIRMA’s mapping adds software packing, masquerading, process injection, DLL side-loading and sandbox/VM checks.
- Persistence and extortion: it modifies the Windows registry to survive reboots, exfiltrates data for a leak threat, and presents each victim a unique decryption ID with email contact details inside ‘Decryption Instructions.txt’.
VGOD execution chain
No free decryptor exists, patching and reputation won’t undo encryption; offline, immutable backups are the only reliable recovery path.
Attribution
VGOD is a documented Windows ransomware strain with two corroborating vendor analyses (CYFIRMA and Foresiet); confidence in the family profile and tradecraft above is high and evidence-based. No named operator or affiliate structure is publicly established, and communication is over email rather than a named leak brand. Critically, the indicators surfaced by our automated triage, a suspicious MD5 and two co-observed domains, are provisional, low-corroboration leads flagged by reputation signals only, and are NOT confirmed to belong to VGOD; treat any VGOD attribution of those specific indicators as unverified pending strong, behaviour-based evidence.
Confidence: 85%.
VGOD deletes your shadow copies before it deletes your options, offline, immutable backups are the only honest recovery plan.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Initial Access | Phishing | T1566 | Delivered via phishing emails with malicious attachments/links, alongside RDP abuse and malvertising (CYFIRMA, Foresiet). |
| Execution | Command and Scripting Interpreter: PowerShell | T1059.001 | PowerShell used during execution per CYFIRMA’s ATT&CK mapping of the sample. |
| Persistence | Pre-OS Boot: Bootkit | T1542.003 | CYFIRMA maps bootkit-based persistence; the Golang build also modifies the registry to survive reboots (Foresiet). |
| Defense Evasion | Rootkit | T1014 | CYFIRMA attributes rootkit techniques used to hide artefacts and resist removal. |
| Defense Evasion | Native API | T1106 | Golang variant issues direct syscalls (syscall.WriteFile) instead of standard APIs to evade EDR (Foresiet). |
| Credential Access | OS Credential Dumping | T1003 | OS credential dumping listed in CYFIRMA’s technique mapping. |
| Impact | Inhibit System Recovery | T1490 | Executes vssadmin/wmic to delete Volume Shadow Copies before encryption (Foresiet). |
| Impact | Data Encrypted for Impact | T1486 | Encrypts files with ChaCha8/AES (or AES-256/RSA-4096) and appends .locked/.Vgod (Foresiet, CYFIRMA). |
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
| 241c3b02a8e7d5a2b9c99574c28200df2a0f8c8bd7ba4d262e6aa8ed1211ba1f | sha256 | Reported VGOD sample (CYFIRMA, Feb 2025), block |
| 5fa2ac374a63d214dab4c3edf26e9b5d | md5 | Provisional triage lead, 53 VirusTotal detections; VGOD association unconfirmed, treat as suspicious pending behavioural corroboration |
cloud-recovery[.]top | domain | Provisional co-observed lead; abuse-heavy .top TLD; not confirmed VGOD infrastructure |
vgod-loader[.]zip | domain | Provisional co-observed lead; abuse-heavy .zip TLD; name overlaps VGOD theming, association unconfirmed |
Detection
Copy-ready hunting query:
# Known + provisional VGOD indicators (treat MD5/domains as suspicious, not confirmed)
index=edr (sha256="241c3b02a8e7d5a2b9c99574c28200df2a0f8c8bd7ba4d262e6aa8ed1211ba1f" OR md5="5fa2ac374a63d214dab4c3edf26e9b5d")
| stats count values(host) as hosts by process_name, parent_process
index=dns OR index=proxy
| search domain="cloud-recovery.top" OR domain="vgod-loader.zip"
# Behavioural hunts for VGOD-style activity (higher value than any single IOC):
# 1) Volume Shadow Copy deletion: vssadmin.exe delete shadows /all OR wmic shadowcopy delete
# 2) Mass file rename to .locked / .Vgod and creation of 'Decryption Instructions.txt'
# 3) Desktop wallpaper change (registry Control Panel\Desktop\Wallpaper) around bulk file modification
# 4) Non-standard direct file-write syscalls from an unsigned/packed binary
# 5) Registry run-key / persistence writes immediately before mass encryptionRecommendations
- Maintain tested, offline/immutable backups and rehearse restore. There is no free VGOD decryptor, so backups are the only reliable recovery.
- Alert on and block Volume Shadow Copy deletion (vssadmin delete shadows, wmic shadowcopy delete) and mass file-rename to .locked/.Vgod; these are high-fidelity, near-real-time signals.
- Harden entry points: enforce MFA on RDP/VPN, filter phishing and block malicious attachments/macros, and patch internet-facing and endpoint software promptly.
- Treat the triage indicators here as provisional, block/monitor the MD5 and domains but corroborate with a second independent source (sandbox, passive DNS, behavioural telemetry) before asserting a confirmed VGOD verdict.
- Assume data theft as well as encryption (double extortion): plan IR for exfiltration, and rotate credentials and revoke sessions for affected systems.
